Cisco VPN :: 5520 Controlling Remote Site Access Through LAN-to-LAN

We have 2 5520 ASA's working in an active/standby function at our central site. The remote agencies have control of their ASA's or other devices able to create VPN tunnels back to the central site. When a new remote agency wants to connect to our central site we assign them a network range that is routable on the central sites network.We ask that the remote agency NAT into the addresses we provided them.This way we are able to route back to them. We assign the interesting traffic and then they we start communicating by way of the tunnel.  
 
Since the central site can't control the traffic coming in on the site to site tunnel other than just defining the interesting traffic AND we aren't able to control the NAT on the remote end how can I put an access list on the central site ASA to allow only certain ports and IP's by way of access list?   Ultimately, I'm trying to limit traffic on the central site coming inbound to only allow traffic I want.  I tried applying a group policy to the lan2lan site to site tunnel, but it failed for some reason. It actually prevented all traffic. Can I apply a group policy to a site-to-site tunnel?  
 
I'm struggling here a bit as I don't have control of the remote end.   They can NAT whatever they want to an address in the range we assigned them.   The tunnels interesting traffic is set to full ip to the central site's destination.  The interesting traffic on the central site is set the same. However, on the central side...I want to limit that traffic to only certain ports by way of an acl.  If it is possible to assign a site-to-site tunnel a group policy and filtering is done in that method, can