The TAC is correct. SU1 is the IPS subscription entitlement for ASAs with the now end-of-sales IPS module.
You should not have been able to purchase it in the first place without an existing SNT hardware support contract in place since that is a required prerequisite.
Your Cisco account manager or reseller should be able to look into it and see how that came to pass. Did the TAC check your serial number for any record of there having been an SNT contract in place at one time?