Yes, Cloud Email Security (CES) vs. Email Security on-prem is nearly identical. One of the only differences you will see is the admin user --- CES you are entitled as "Cloud Admin" vs. on-prem you can have/assign "Admin" --- meaning, you see the underlying IP/network configuration.
With CES, when you first are enabled, be sure to request CLI access. This will just need to be setup via Bastion access for you to your deployment.