I think that would be an excellent approach - seems like it gives exactly the right privileges to each user.

The cool thing I hadn't even thought about is, I could manually add an additional user for a client as a Publisher but could access CE - for instance, to handle billing or such - but he wouldn't have cPanel access, which would be reserved for the main account owner.