They shouldn't need any. Just enable the UDP encapsulation (now might be called NAT traversal, as it is a draft IETF standard) feature, and everything should just work.
You might have some hiccups in the following situations:
1. some routers have IPSec pass through features that anticipate a pure IPSec connection, and not a NAT-T one (NAT-T is simply IPSec encapsulated in UDP packets). These might get annoying.
2. Some ome users will go wireless, and might install a wireless nic after the vpn client - this might not work as the deterministic network enhancer component might not get installed for that particular nic
3. Some routers have responses to ping requests blocked - this might break the isakmp keepalive (dead peer detection - stop connections from terminating). I just heard about this, need to do more research.
You might want to take it upon yourself to announce a recommended router. I disavow supporting any of them, but I still occasionally have to field questions. I have a small highly technical user base those (software architects and engineers), so it isn't too painful. Your mileage may vary.
