Using Carbon Copy Cloner 4 to create encrypted bootable HFS+ clones from APFS source
Here's what worked


Download the High Sierra installer from the App Store.
Run the installer, choosing the external clone disk as the target. This will automatically create a new Recovery HD partition associated with the target disk.
Reboot from the external disk. Hold down option key during startup to select the boot disk.
Enable FileVault encryption as usual from the Security &amp; Privacy panel in System Preferences.


Additional Notes


You can reboot from your internal drive for better performance, after enabling FileVault on the external. The encryption task will continue as long as you're plugged into power and the external disk is connected.
It may take several hours, or even days, before encryption is done, depending on the volume of data to be encrypted.
You can view encryption task progress using the Terminal command diskutil cs list


What didn't work

There are some articles posted about how to clone the internal disk Recovery HD volume to any other drive, but I didn't have success with them:

$ diskutil list
/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *500.3 GB   disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:                 Apple_APFS Container disk1         499.4 GB   disk0s2

/dev/disk1 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +499.4 GB   disk1
                                 Physical Store disk0s2
   1:                APFS Volume Mac-HD                  431.9 GB   disk1s1
   2:                APFS Volume Preboot                 22.9 MB    disk1s2
   3:                APFS Volume Recovery                518.8 MB   disk1s3
   4:                APFS Volume VM                      2.1 GB     disk1s4

$ sudo hdiutil create ~/Desktop/Recovery_HD.dmg -srcdevice /dev/disk1s3
hdiutil: create failed - No such file or directory


I didn't find any articles that specifically addressed the case where the source disk is APFS format.