Originating from the SA, the NC traffic will not be NATed. Each IP address will correspond to a user session. As long as you are monitoring your traffic before it gets NATed out on the perimeter (assuming that's what you're doing,) you should have visibility into their activity.
