This question is better suited for http://security.stackexchange.com sister site.
Client-side certificates should not be signed by a recognized CA; more precisely, they should be signed by such root/intermediate that only ever signs what you trust to represent your clients.
Obviously public root belonging to a recognized CA does sign other certificates than your clients; signing a certificate with some Subject text (CN) is the same as trusting that whoever requested signing is entitled to act as that Subject. This means a recognized CA by its very nature 'trusts' much more Subjects than you would trust. In other words, your server needs to take extra care to distinguish the Subjects that you trust from all the bunch.
Publicly recognized certs are also an extra cost to buy and to renew.
While there could exist solutions by recognized CAs that fulfill your requirements, they would be always more costly, more complicated, and far less secure than signing on your own (with your own root, after your own process of client identity verification). It doesn't make any sense to me.
Even worse solution is to pay for public certificates, and then remove all the public roots from your trust store and only add specific end-client certificates one by one. This "compromise" simply joins the costs of both alternatives without any of their respective benefits.
Update Professionally I often cooperate with banks and PCI processors for e-commerce payments. Most often they require their own CAs for both server-side and client-side certificates and refuse to use publicly recognized CAs.