Putting it all together

For each upstream, we have route-maps which say, “Announce this network to this upstream” (configured on every IBGP router) which tags the network with communities.
On each border router, we have route-maps which filter inbound and outbound announcements.
Inbound filter gets rid of nasties (e.g., don't want to hear our own prefixes from an EBGP peer!)
Outbound filter selects prefixes tagged with that upstream's communities and blocks everything else.

For each upstream, we have route-maps which say, “Announce this network to this upstream” (configured on every IBGP router) which tags the network with communities.