If I understand correctly then I believe what you are doing should work. Use a static route on the MX to the MPLS CE router (the MPLS CE router will need the reverse route), you will also need to include the static route into the AutoVPN so that the remote sites learn of it (i.e. 'VPN on' under VPN participation).
When you deploy the branch (spoke) sites you make sure the Default Route check box is clear in the Site-to-Site VPN configuration, and the site's Local Network is set to 'VPN on' for the VPN participation. This way for IP routes that are advertised over the AutoVPN the traffic will be tunnelled to your concentrator, for all unknown routes the traffic will be NATed by the MX and sent to the internet.
When you move fully to the cloud you could still use the Auto-VPN between sites, and quite possibly also to the cloud service, although that depends on whether you're moving to an IaaS or SaaS cloud offering.
EDIT: if you're doing a redundant pair of MXs then you would be best off connecting the CE MPLS router to the switch, otherwise losing an MX could potentially mean you lose the connection to the DC. That said, the switch then becomes the single point of failure, so I suggest you give some thought to what you are trying to achieve with redundant MX appliances, and what your failure scenarios are.
