I'm of the opinion that it should be kept the simplest possible and let
people deal with their own networks. Give the people the basics needed to
create a connection and get the routes. Then if they want to block people,
they can add a static route dropping them or a firewall rule.
I feel BGP over GRE or DMVPN is overkill as beyond the extra functionality
of GRE being able to do multicast and other kinds of traffic, there is no
added value to what we already have with IPIP and RIP44d/encap. Within
44net, it's a different story - go RIP/OSPF and IPSec for all I care. But
setting up tunnels should be kept simplistic.