In your case the only address routing across the IPSEC tunnel will be the GRE tunnel address. Anything that is routed to the IPSEC tunnel will be immediately encapsulated and sent down the tunnel for the other side.
You want the remote subnets routed to the GRE interface where they will be GRE encapsulated. Then this stream will be routed to the remote GRE ip address via the IPSEC tunnel interface.
If you route these remote subnets to the IPSEC interface they will be regular IPSEC and not GRE over IPSEC.