The AnyConnect client is used for either full tunnel SSL VPN or full tunnel IPsec (IKEv2). Either method requires an SSL certificate on your ASA. You can use self-signed, private CA, or public CA / RA as the source of your certificate. Cisco recommends the third option as it will be recognized as a trusted root CA automatically. Option 2 requires your clients import the root certificate from the sigining CA into their trusted root certificates store. Option 1 requires they import the self-signed certificate.
As far as setting it up, you can follow the remote acess VPN wizard in ASDM. If oyou go the public CA SSL certificate route, you should have that in hand ahead of time.
