Hey Joe,
This may not be 100% accurate to your requirements.
But.
The Encryption Key once purchased, added to your device.
You can restrict which users will be able to send out encrypted email through the use of Filters/Content Filters/Policies.
In essence, you can allow a subset of users to be able to send encrypted envelope emails outbound, while other users will only be able to send emails as per normal plain text (or under TLS if you've have that enabled).