Even though VPN-WAN rule is disabled then also SSL-VPN Remote Access users are able to connect to SSL-VPN

You need to separate the TAP Adapter from the Connection of a application.

You can have a Tunnel enable, which means the client is able to send traffic to the firewall over the VPN Tunnel. 

On the firewall rule page, you can allow or deny the traffic coming "through" the tunnel. 

But the tunnel itself is not affected by the firewall rule. The tunnel can be controlled via Device Access.

You keep using the word "connect" and it sounds like you mean "send traffic through". Connecting to the firewall via SSL VPN is 100% controlled by your SSL VPN setting. Traffic flowing over the VPN and to somewhere else through the firewall is controlled -- as is all traffic flow -- via firewall rules. Two very different concepts.

I mean to say that users click on SSL-VPN client, connect to there required SSL-VPN Connection.

Till this I hope you are clear?

Now as soon as user gets connected they are able to RDP even though the firewall for SSL-VPN (VPN-WAN) is disabled, How ?