I don't think the "No NAT with crypto" option applies if you're using two interfaces. Like you said, the crypto map is only attached to the outside interface.
We had a configuration need similar to yours cbbristol, except that our CSR and endpoints...