Hi again,
I have now tried this in the lab but it seems these examples implies you need to use some routing-protocol between the spoke PE-CE. As mentioned in my initial post I need to use static routes on the spoke sites (the hub site/sites will be BGP though). I guess there is no good way to do this then without using ACL if I want to prevent the spoke sites from reaching each other directly?
Erac