The ACL associated with a point to point VPN should always contain both source and destination information. To classify "interesting traffic", that is the traffic to be protected and then sent to a remote endpoint, Cisco devices (routers and L3 swithces and ASAs oh my) will look at both source and destination addresses. If you would like a singular host to be able to send traffic to an entire remote Class C, then your ACL would look like the following:
permit ip host 192.168.1.100 10.10.10.0 0.0.0.255
If this is not specified and you just have
permit ip any any
Then how will your router know that it is not supposed to take traffic from another local sunbnet and encrypt it. Furthermore if you are running NAT on the same device, it adds further confusion. If your external IP on this VPN device is a public IP, then it also falls within the "any" statement of that ACL.
"The reason they cited was because keeping the crypo ACL open like this and then limiting it with an ACL on the interface, you would cut down on the number of SA's built. How does this cut down on the number of SA's and is this the most efficient way to design VPN's?"
This is technically incorrect, you will only have a singular SA (security association) between the devices for each tunnel, not for each individual TCP session or traffic flow.