The 2850 would be your edge router connected to the internet, so the NAT rules should be placed only on that router, not on the MPLS one. Depending on how many public IPs you have and if you want to dedicate one for the firewall, or if you are using one single public IP and you want to redirect only the traffic destined to the ISAKMP and SSL VPN. Assuming you are using the traditional NAT on the 2850 router, a one to one NAT rule would look similar to this:
ip nat inside source static < private IP of the firewall > < public IP >
If you want to do port mapping it would look like this:
ip nat inside source static tcp < private IP of the firewall > < port > < public IP > < port >
Example:
ip nat inside source static tcp 192.168.1.1 443 1.1.1.1 443
