How to force Disk Encryption password on boot for ALL users?
Ok, so here is half an answer.


With a first admin account (e.g. admin) you create another one (admin_tmp) and you log into.
In the terminal you remove the first account from being able to unlock the disk with fdesetup remove -user admin. Meanwhile its SecureToken switch to Off.
You logout and log into 'admin'. Then from the Users accounts Preferences you remove the admin_tmp from the system.
Then you have an admin account with no SecureToken which seems to be the only way to force a Disk Encryption Password prompt on boot. Next accounts will inherently have no SecureToken, hence no allowance to decrypt the disk with their own password.


That's not ideal as this may break some stuff (See my Note in the initial post)