Cisco IPSec over MPLS

Hiyo networking guru's of the reddits.

Just after some very basic info/help on getting this working.

A new client really wants some encryption over their newly provided MPLS VPN - i.e. they are not doing the MPLS but they run a hub/spoke network over their providers MPLS, so they see an interface per router with an IP.

Previously i've set this up using DMVPN or similar tech (im not usually on Cisco hardware) but what I thought would be handy would just be to encrypt traffic on the interfaces rather than create GRE tunnels over an already 'private' link.

How would one go about setting this up for hub/spoke network? Consider it 1 physical interface on the hub, 1 physical interface on each spoke, and just all traffic between those interfaces encrypted.

Thanks in advance for any help