When you configure SSL VPN whether with AnyConnect or as a clientless VPN, the ASA activates the web portal. In case of AnyConnect VPN, the web portal in itself is not responsible to establish the VPN tunnel, and it would only be used to download the AnyConnect client. So shutting down the web portal will not affect the AnyConnect clients from connecting to the firewall.
The portal can be shutdown with the command "keepout" under the webvpn section, and it can also be shutdown via ASDM from "Configuration > Connection Profiles > Shutdown portal login page". You can add an informative message if you want to the users stating that there are no available web services on this firewall or something similar, or, you can just leave it in blank without presenting any message.
It is a good practice to shutdown that web portal unless you have 2FA authentication method configured on the firewall. The reason behind this is that unfortunately the ASA and still the FTD do not provide any geo protection mechanism to the traffic destined to themselves. For example, if you want to block the traffic to the firewall web portal from all over the world and allow it from a single country, you cannot do this easily with the firewalls. You could rely on the control plane access lists, but honestly they are not practical to use. Check out this post of mine if you are interested in knowing more about this:
Using the Firepower geolocation | Blue Network Security (bluenetsec.com)
When the users open up the web portal, they see the login page by default, however, if you have multiple tunnel groups (not group policies) configured, then the users will see the tunnel groups drop down menu where they can select the tunnel group they belong to. This allows say segregating the users accesses, for example, the normal end user selects Users tunnel group, and the IT admin selects IT tunnel group. You can change the names displayed on the drop down menu, those can be changed by creating aliases of the tunnel groups configured.
With regard to authenticating against RADIUS, or even 2FA, that will be part of the tunnel group configuration you apply, specifically the authentication server you would associate to the tunnel group.
