We do exactly this. First, you have to change your CPE config to have two interfaces for each WAN service. One for PPPoE, one for management. Our management network lives in the 172.16. 0.0/12 IP space and gets its IP via DHCP. We hard-code the ACS IP into the CPE, but also send it via option 43. This allows us to switch a CPE from the production to the test network without having to reconfigure it. On the test network, the DHCP server sends a different URL for the ACS.
When the CPE boots up and connects to the ACS the various provision scripts we have check what state the CPE should be in (routed or bridged) and then applies the appropriate configuration to the CPE.
Because the CPEs always have a management connection, we always have access to the CPE no matter what mode its in (routed or bridged). And it also allows me to disable the PPPoE interface when a customer is disconnected for non-payment. This prevents the CPE from hammering on the radius server.