"Ensure all external recipients use the OME Portal to read encrypted mail" in the article below is misleading. The instructions lead you to encrypting every outbound external message. It would be nice to ensure external recipients OF ENCRYPTED EMAILS use the OME Portal. Even better, ensure some external recipients (based on criteria like recipient domain) OF ENCRYPTED EMAILS use the OME Portal.

https://docs.microsoft.com/en-us/microsoft-365/compliance/manage-office-365-message-encryption?view=o365-worldwide#ensure-all-external-recipients-use-the-ome-portal-to-read-encrypted-mail