I did the p2p between any sensible nodes in my network then added routing layer via BGP so any node can "see" any other node regardless of underlying mesh.

The access limits are better served by firewalls than limiting tunelling