A network engineer must deploy a VPN solution connecting one central hub to 200 branch offices. The design must support dynamic spoke-to-spoke tunnels that build on demand, use multipoint GRE with NHRP for address resolution, and minimize hub configuration overhead as new spokes are added. Which VPN deployment type best satisfies these requirements?