Force URL filtering for AnyConnect Users?

[zac_hg]

Hello - I'm looking for some way to force AnyConnect VPN users to go through the PAN which is on the inside for URL Filtering.

A couple of caveats:

- Can't move to GlobalProtect because of ISE integration with AnyConnect.

- Want to use PAN for URL Filtering. Moving away from Proxy technology

Remote AnyConnect VPN Users------>--------Internet----BGP--------ASA FW---------L3 OSPF------------Firepower-----------L3 OSPF-----------PAN FW with URL Filtering-----OSPF------Internal LAN

Options I can think of 

1. Add connectivity between ASA and PAN so that the PAN is inline or before the ASA (vWire or L3)
2. Use PBF/PBR to force the web traffic to Firepower then to PAN 
3. Move the PAN above ASA 

Does anyone have any other suggestions? Thanks so much!