Where does a VPLS WAN connection connect

I have some confusion regarding where an ISP controlled VPLS WAN connection between remote sites would connect in a network topology. For example, would the connection go into a core layer 3 switch behind the firewall or would it go into an external interface on a firewall like any other ISP connection with a VPN tunnel between sites? My lack of understanding partly come from having only used layer 3 IPSec VPNs before.

Thanks!