The router will only encrypt traffic that you tell it to, everything else, including standard Internet traffic, will go out the dialer interface as normal (and be PAT'd if that is what you've set up).
So, how do you tell the router to encrypt specific traffic. You do this with an access-list that is then applied under your crypto map. In your router you'll have something like the following:
crypto map 10 ipsec-isakmp
set peer x.x.x.x
set transform
match address 100
interface Dialer n
crypto map
access-list 100 permit ip <1721 local subnet>
Now, when an unencrypted packet comes into the inside interface, the router looks at the destination of the packet. It looks up its routing table and sees that the destination is out the Dialer interface. It also sees that there is a crypto map on the Dialer interface, and so it checks first to see if the packets source and destination match access-list 100.
If it does, then it encrypts the packet, puts a new IP header on it with a destination of the IPSec peer at head office, and sends it out the Dialer interface.
If it the packet doesn't match access-list 100, then it knows to just send it out as any normal IP packet. If there is a NAT statement on Dialer 0 and the packet matches the nat policy, then it will be NAT'd before sending.
