We have used the following technique for a similar situation.
We have added a custom field to the License object in our LMA org and added a Force.com site (so public, meaning no authentication is required) @RestResource GET API that allows the value to be accessed for a specific org. The underlying query of this form:
where sfLma__Subscriber_Org_ID__c = :subscriberOrgId
and sfLma__Package_Version__r.sfLma__Package__r.sfLma__Package_Id__c = 'xxxxxxxxxxxxxxx'
Then in our managed package that value is queried over HTTPS with the request providing the org ID and the returned value is cached in a protected custom setting.
As the customer cannot tamper with that managed package code and cannot alter the value returned from the LMA org (without some serious network hacking), we can use the CustomField__c value to enable the managed package code features. And changing the enabled features just requires a simple edit of the LMA app License object.
(You could also use multiple additional managed packages to provide flags. At its simplest the managed package would be more or less empty - one managed package per feature - and the base package would just use the UserInfo. isCurrentUserLicensed API to see if the feature is licensed. Or you could just query for a marker class of the expected namespace included in he additional managed package.)