I'm of the opinion that it should be kept the simplest possible and let people deal with their own networks. Give the people the basics needed to create a connection and get the routes. Then if they want to block people, they can add a static route dropping them or a firewall rule.
I feel BGP over GRE or DMVPN is overkill as beyond the extra functionality of GRE being able to do multicast and other kinds of traffic, there is no added value to what we already have with IPIP and RIP44d/encap. Within 44net, it's a different story - go RIP/OSPF and IPSec for all I care. But setting up tunnels should be kept simplistic.