Unfortunately, the answer is "it depends" (sorry, I don't like when people answer this).
It really depends on your requirements and preferences.
My recommendation would be to have a central hub and indeed have all the spoke connecting to it. That being said, while this is the ideal architecture from a security point of view (central point of management), it might not be the ideal architecture from a networking perspective.
Depending on your requirements, you might find that it is better to have multiple hub and spokes networks, all with their own NVA, connected together through each Hub. This of course increases the cost (appliances, maintenance, etc.), and the security exposure, but it's a much better design from a networking perspective.
I would also recommend to look at Azure Virtual WAN:
Hope this helps,
(Please don't forget to accept helpful replies as answer)