Using client certificate that are not issued by you poses some threat.

Anyone who know the email of one of your user and can found a CA in your trust list that is not very strict about user verification, can get themselves a forged certificate with this email. Then they can access the private section.

Managing your own PKI is complicated, but can solve this issue. 

Giving a signing certificate is turning the burden to the client's company, which might or might not be a good idea depending on their expertise and trust-ability to operate the PKI seriously.

At the end, the answer is always "it depends". You have to compromise between the risks and costs of dealing with the risks.