we are likely to go over if everyone is tunneling their traffic through the EC2 instance
Why?
It's the same amount of traffic between AWS and you (plus the overhead for the tunnel encapsulation) if you go through an EC2 instance or if you connect directly to RDS from the Internet.
Data transferred between Amazon RDS and Amazon EC2 Instances in the same Availability Zone is free.
If you configure the EC2 instance on the same AWS account and in the same availability zone then you'll be billed (or be using your free tier allocation) for data transfer from EC2 to the Internet instead of being billed for data transfer from RDS to the Internet. The free tier bandwidth allocation is for all services combined, not per-service, so I don't see a significant difference in your potential cost.