We have a similar setup, but we have two firewall pairs, one on the internet connections and another in concentrator mode to terminate all the VPNs. The MPLS circuits don't have direct internet access so terminate on a L3 switch with the firewalls all connected to that.
If my answer solves your problem please click Accept as Solution so others can benefit from it.