Using client certificates that are not issued by you poses some threat.
Anyone who knows the email of one of your users and can find a CA in your trust list that is not very strict about user verification, can get themselves a forged certificate with this email. Then they can access the private section.
Managing your own PKI is complicated, but can solve this issue.
Giving a signing certificate is turning the burden to the client's company, which might or might not be a good idea depending on their expertise and trust-ability to operate the PKI seriously.
At the end, the answer is always "it depends". You have to compromise between the risks and costs of dealing with the risks.
