TLS enforced and TLS opportunistic

Hi I need help on setting up TLS communication for our partners we do business with. We have Ironport in our environment and we like to use TLS enforced for some domains and TLS opportunistic for some other domains.  Is this a change we do on our Exchange server (possibly receive connectors), or this can be done on Ironport, and Exchange can be left alone?

And the reverse applies too, where our partners only accept TLS require emails. In that situation would have to make this change on Exchange only (possibly send connectors), or just Ironport, or both?

Thanks everyone in advance!

ms