That's what I would do, but then again I have a business degree and as such won't be interviewing for any engineering jobs any time soon. In other words, I can't say. However, since he said "control and access" I would have said that you need a mux and demux.
Maybe he just wanted you to elaborate or engage him further on what kind of devices you would be controlling, communication protocol, etc.
When I read your interview question, I thought the same as you (use a mux). Thinking further, I think I would have had to ask several questions:
1. What is the control signal? On/Off, serial, binary.....
2. Can the devices be programmed to accept an address (identifier)?- with eight IO pins you should be able to address....255 devices.
These questions would have to be answered for me to start answering the question....
(1) I would be happy to provide you with a quote if you can provide fully qualified specifications.
(2) If you don't have specifications I could help you write the specifications at a reasonable T&M rate.
(3) Damn it Jim, I'm a Doctor, not an Engineer.
and, how about,
(4) If you'd like, I can probably show you how to do it with 6 GPIO pins (LOL)...