Cisco :: L3 4948E-E/4948E-S Switch With ASA Configuration?

I have been asked to look at designing a network internally. I have no control of the upstream network besides requesting changes.Essentially I'm confused as to the best way to approach configuring the following and wondered if you could share any experiences. It's stretching the limits of a CCNA IMHO, although I understand a lot about networking this is one area where I'm a little sketchy.

Kit list:

4948-E-S or E-E switches.
Cisco ASA 5545 firewalls
Cisco ASA 5520 firewall
& Multiple L2 switches

- I have 3 subnets in total, a /29 for routing and two larger subnets routed to the /29

What I'm trying to do:

1) Have some hosts protected by the ASA 5545 firewalls, probably in routed mode (that's the confusing part). I cannot use NAT so the inside interface/VLAN would need public IP's.

2) Have some hosts not protected by the ASA, therefore straight out onto the public Internet with no firewall whatsoever, they connect directly to the L3 or to the L3 via a L2 switch.

3) Have the ASA 5520 take an IP from the public (non-protected range), as this will be a VPN endpoint too and will also need to have NAT enabled. This should be easy as it just takes an IP from a public subnet, the ASA 5545's are the tricky part as they cannot use NAT at all. I've also been advised not to use Transparent mode either.

4) L3 switches are essentially external switches, doing the routing for our subnets, before upstream.

5) Upstream provider provides gateway with HSRP, we're looking at using HSRP and a routing protocol on our side over two 4948 switches. Any recommendations on this?

6) Further to point 5, we do not currently have any ability to do BGP or anything. That would be done by a separate team, upstream.

Note: I've also got to justify the use of each IP to the network management team, they are quite stingy so I have to be careful that I don't waste too many IP's for core network. So what I'm thinking is I have to create subnetworks of my main subnets to break them up into smaller pieces, and then add some onto the inside interface of the ASA and others will be on the L3 switch. Then of course route the networks to the ASA outside IP. Saying that, I'm not clear if I should create a /29 or /30 to route to the outside of the ASA or grab one from the larger subnet as it were? The final outcome is that we can connect a machine directly to the Internet or behind a firewall, depending on the requirements for that individual device. All devices will have public IPs.