What you want is called a VPN-filter. It’s just a normal extended ACL, but how you apply it is what makes it a “VPN-filter”.
So, if you want to allow your VPN subnet to only talk with something specific, you would build an ACL such as:
access-list VPN-Filter extended permit tcp 192.168.100.0 255.255.255.0 host 192.168.200.200 eq 3389
access-list VPN-Filter extended deny ip any any
You then apply it to the group-policy that your tunnel-group is set to use. Be careful, though, because unless you set your tunnel-group to use a specific group-policy, it will use the default group-policy, and applying a VPN-filter to that means it will affect all of your tunnels that also use the default policy.
To apply it to a group-policy, you would have something like:
group-policy VPN-Policy internal
group-policy VPN-Policy attributes
vpn-filter value VPN-Filter
Assuming your tunnel-group IS using the default group-policy, to apply the customized group-policy to your tunnel-group, you would have something like:
tunnel-group WebVPN-Tunnel-Group general-attributes
So you know, anything not defined in a separate group-policy such as what I have above will then fall back to the default policy. For example, if this custom group-policy doesn’t define DNS servers to use but the default policy does, the ones listed in the default policy will be used. If you have DNS servers set in both, the ones in the custom policy will be used (they override the default policy for that specific line item).
It was my mistake for forgetting on this (and your follow-up question here) that clientless VPN doesn't use vpn-filters like client VPN does, and you have to use a WebType ACL to filter traffic based on either URL or TCP-based destinations.
You can still keep the existing VPN-filter in place in case you want the same filtering on a client as well, but it can't be the same ACL since they're different types, meaning you will have 2 ACLs to maintain if you want to make modifications later. Another caveat is that WebType ACLs can't use objects or object-groups - they need to be literal.
To create a WebType ACL, you can add the following to your policy:
access-list CLIENT-VPN-LIST-WebType webtype permit tcp host 192.168.50.2 eq 3389
access-list CLIENT-VPN-LIST-WebType webtype deny tcp any
access-list CLIENT-VPN-LIST-WebType webtype deny url any
And then to add it to your existing group-policy, you can type:
group-policy CLIENT-VPN-POLICY attributes
filter value CLIENT-VPN-LIST-WebType
You will need to log out of the VPN portal and back in for it to take effect.