Current limit a bus-powered usb 3.1 hub
There are several things to consider if you want to design a USB-IF compliant hub.


A bus-powered USB hub must have means to disable power to downstream ports, see Section 7.2.1.1 of USB 2.0 Specifications, which says: "Power to external downstream facing ports of a bus-powered hub must be switched."
The 100 mA unconfigured limit is usually maintained by controller IC itself, otherwise the silicon won't get certified. Unconfigured hub IC won't engage downstream power, so no-one else will draw it from UFP but IC itself, and this is managed by IC.


So no, you don't need to "limit the hub's power drain" by any special means, but you must use high-side power switches on all DFPs to be compliant.