Once a site  is provisioned there is very little that changing the
original template  will do to change the site. This hasn't really
changed since SharePoint 2003.

Let me suggest a third alternative. Since you will be using an approval
process to add content  to the site why don't you add setting the
Security on each item as part of the approval. That way no matter what
users do they are only allowed to see what they have security to see.
In my opinion this would be a better solution than audience filtering
because audience filtering will not filter items if the user goes
directly to the list. This would also keep you from having to put
multiple CQWPs on the page to support audiences.