SQL Server End to End Encryption Options
You are correct; SSL is the official means to support encryption for data in motion.


  Microsoft SQL Server can use Secure Sockets Layer (SSL) to encrypt
  data that is transmitted across a network between an instance of SQL
  Server and a client application. The SSL encryption is performed
  within the protocol layer (technet)


Always Encrypted is a bit deeper. It encrypts the data at the client application before it is transmitted, and never stores it in any unencrypted way. So the data that's encrypted via Always Encrypted is "safe" while in transit and at rest (stored as encrypted data), but the packets themselves are NOT encrypted at the network level. (MS Docs)

So if you want to prevent your DBAs and/or report writers from viewing cleartext data (such as credit card numbers or social security numbers), then Always Encrypted is a possible tool to get that level of security.

But if you don't want a packet monitoring tool to see your database username and password, or to see cleartext data as it moves from DB to application, then you must use SSL.