SSH has ProxyCommand which accepts the %h template.

Provided your users will configure something a little - or you provide a wrapping command - you can setup the tunneling for them.