The network will be MPLS in the future and I am thinking about new design for it. We will have hub router with ASA behind and couple spokes without the need for IPsec (at least for now). ASA won't do any NAT at all, all will be controlled with ACLs on each interface, NAT will be done on HUB with PAT for LANs and Static for server in DMZ.
So Public facing interfaces on Routers are in VRF OUTSIDE. Then tunnels between them are also in VRF OUTSIDE. On hub, VRF OUTSIDE points into ASA. ASA does the inspection with Outside-In ACL. Then it points the traffic to Hub again BUT Hub's int facing ASA is in VRF INSIDE. Then that VRF has default route towards ISP's router + applies any NAT needed.
Am i correct?