Which lodash template delimiter policy fits untrusted HTML values?

We need a lodash 4.x template policy for rendering user-controlled values in HTML. The unresolved choice is whether to standardize on the escape delimiter <%- %> with explicit per-call options, or permit templates to inherit the mutable _.templateSettings. Default <%= %> interpolation inserts raw content, whereas <%- %> applies _.escape.

Template source must remain trusted because the evaluate delimiter <% %> executes JavaScript during compilation. HTML escaping is also context-specific: _.escape does not by itself establish safe encoding for script blocks, CSS, URLs, or every HTML attribute context. The installed lodash version and existing uses of _.templateSettings or explicit delimiter options need review before a policy can be considered settled.

Should HTML templates require explicit per-call delimiters, or may they rely on global settings? Which encoding approach should cover non-HTML-text output contexts?