Stateful Firewall is disabled by default, so I'm not sure why you're having problems with this. Are you saying it's on as soon as they install the client?
You can tell if it's on if it has a tick next to it under the Options menu. To turn it off (if it does have a tick next to it) the user simply needs to select it under the Options menu, the tick should disappear and it is then off. They don't need to play around with shutting down the services or anything like that.
If it is on as soon as the client is installed, then you or someone may have set this specifically in the vpnclient.ini file that is distributed with the client. Read the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/vpn/client/3_6/admin_gd/vcach2.htm#1151926
and then look for the:
StatefulFirewall=1
command. You can set this to 0 and then when the client is installed the firewall will be off (but as I said, this is the default so there may be some other problem occurring here).