I too have just hit this exact scenario.
0. Started with a third party vpn with a center site with encryption domain with ALL networks. VPN traffic always routed thru center site over MPLS.
1. VPN community1 designed for MPLS backup. MPLSbackupcommunity works and all site are accessible via remote client thru center site. VPN option is set to second option.
2. Internet access goes out local firewall.
3. Second VPN community to third party. Third party community works and is accessible via remote remote client thru center site.
So I see two options:
1. Add all remote sites with firewalls to third party VPN. Not an easy to implement as third party was already defined with all remote sites. We do not have the ability to change the remote side of the third party vpn.
2. Set VPN option to third choice and route all internet AND VPN traffic thru center site. Bad choice due to the increased load on the internet connection on the center site.
The question remains how to do third option on VPN, but still allow internet access out the remote local firewall.