Hi!
In general - you will need Layer 3 connectivity to establish your tunnels between the Hubs and Spokes.
So no "special" underlay is required.
Mosty DMVPN is used over the Internet.
You can encrypt the MultipointGRE Tunnels with IPSec, therefore it is really cool way to establish WAN Connections to remote Sites over the Internet.
Here is a good document describing the benefits:
https://www.cisco.com/c/en/us/products/collateral/security/dynamic-multipoint-vpn-dmvpn/data_sheet_c78-468520.html
As you read in the document:
"Cisco DMVPN is the preferred solution for organizations requiring encrypted WAN connectivity between remote sites. Factors include the cost-driven use of the Internet to replace or provide backup for private leased lines and Frame Relay links, and regulatory pressures requiring encryption of private WAN links."
"Cisco DMVPN allows these sites to connect over the Internet, providing privacy and data integrity while meeting the performance requirements of business-critical applications."
Does this answer the question?
Just let me know! :)
Best regards
Julian
P.S.: pls always mark helpful posts or mark solution if applicable
