You can add multiple servers in this group, so you have internal DNS servers first, followed by public ones. I haven't tested this behavior, but I would assume that ASA would send all of its requests to first DNS server, and, for as long as it receives replies, it would continue using same server. This way, it would never reach your public server, as I would expect that your internal DNS returns blank reply (and a valid question is why your internal DNS doesn't resolve this public FQDN?), but it would reply.
There is an option to use multiple DNS groups, and to assign it per tunnel-group, but I never tried this. In my understanding, you could define one group (e.g. default one, which is already used) and to assign it globaly. Then you could create another one, by using commands provided above (just change name), and then assign that group to newly created tunnel-group in which you are experiencing issues by using:
ciscoasa(config)# tunnel-group test type webvpn
ciscoasa(config)# tunnel-group test webvpn-attributes
ciscoasa(config-tunnel-webvpn)# dns-group dnsgroup1
As I said, I never used it before, so can't be sure if it will work in this case, but you can try and let us know. You can find reference here.
BR
Milos
