lan to lan tunnels are associated with pix's outside ip addresses. You could do what you seek with just one ip address. After you use one ip for the outside interface, you can assign the 2 others to the global pool.
You will have:
nat (inside) 1 0 0 (enable nat for everything)
nat (inside) 0 access-list xxxx (selectively disable nat)
access-list xxxxx (specify subnets for which you will not be using nat, most likely, the ip range used internally on the other pix for the lan to lan tunnel, and the ip range you will assign to vpn users via ip local pool
