[j-nsp] Best device to fit for a project

[R S]

For a project (70 branch offices and 2 Headquarters connected in an hub&spoke topology with IPSEC over MPLS among branch and HQ) I’m looking for the best device which cover the following items:

Branch:
Single device 
At least two Ethernet interfaces (WAN/LAN)
Ipsec supporting 10-50-100 Mbs
Routing protocols such as BGP-OSPF
NAT
Redundant power supply (some site not but in principle I need it)

HeadQuarter:
Single device with XE intf 
At least two Ethernet interfaces (WAN/LAN)
IPSEC supporting up to 7-10 Gbs of IPSEC (the sum of branches)
Routing protocols such as BGP-OSPF
NAT
Redundant power supply

Firewall is not needed, MPLS will be runned by the carrier, the devices and IPSEC are on-top of MPLS.
I’m looking for the best solution in terms of scalability and price (very important).

Also any advice with experience for the decision is appreciated.

Regards