Hi,
- when users only access web applications:
for this need you can do it using Web access management (using just a security policy). You don't need a Full VPN
- when users need access multiple networks services:
In this case you need a full/split VPN
- when users need remote access to email:
Depending you need you can use Web access management (using just a security policy), i'am talking about OWA. But if you need to access to your email using ActivSync you can also do it using a security policy (cert auth). You don't need Full VPN
- when users require access to a terminal server:
If you need a terminal server you can set App tunnel or Split VPN with ACL.
hope it's clear. keep me in touch if you need more details.
regards,