Possibly I misunderstand what @paul driver proposes, but is what he proposes selectively control whether specific spokes can intercommunicate or not?
If if only controls all site to site usage selection, I may have also misunderstood OP's request because I took it as the intercommunications between spokes would depend on specific hosts (or subnets), i.e. one site's host/subnet may be allowed to intercommunicate, directly, across a spoke to spoke tunnel while another host/subnet, at the same site, had to transverse via the hub.
A@Fred Stanton later reply notes "this works", so confirmation of what it actually does, would be appreciated.
BTW, like @Giuseppe Larosa , what came to my mind was PBR.
Also BTW, to @Fred Stanton , why the need to do this? The only "benefit" I can see, is for some reason, adding latency to some traffic, unless somehow you have multiple physical connections to the "cloud" network, and you're trying to accomplish some form of traffic engineering, taking advantage of multiple physical paths, for specific goals.
