Multi-site, shared users, paid access
CAS module is a nice option, and it is quiet stable in D8 (using it in production site since more than a year). Morerover, SSO looks more confortable for users that don't have to reconnect when they jump from one site to another.

You should know that each D8 site will have its own user table created by the CAS/Externalauth modules'stuff. 
If you plan to grant different access permissions based on something (many payments methods), imho, you should store these infos somewhere regardless to drupal (more precisly : anywhere your CAS server can retrieve, i have not tryed cas_server). Those could be retrieved in attributes sent during connection according to CAS protocol (CAS parameters).

Note : Given the fact each of you websites store its user table, and do not necessarily know the existence of an user "x" until its first connection to this site, you just have to pay attention on duplicates. Easiest way is probably to use email as UID but you undestand the idea.