Can only specific SQL users be forced to use TLS?
The option for forcing encryption from the server side is either all or nothing.  There is no way on the server side to configure it so that it only forces certain logins or connections to encrypt.

Clients, however, can be configured to either encrypt the connection or not.  For example, adding encrypt=true to a Microsoft JDBC connection string, or SSL=require   to a jTDS connection string will configure that client connection to be encrypted.  If you're using an ODBC DSN, the configuration typically has an option for encryption as well.  You should be able to quickly learn how to configure a given SQL client for encryption by doing a bit of searching on the Internet.

One note of caution is that you may need to update SQL Server and the SQL client that is being used if you are forcing TLS 1.2 (see TLS 1.2 support for Microsoft SQL Server).  The latest release of the jTDS driver has a defect that causes it to fail with TLS 1.2, but there is a developer build available in the forums with a fix.  The last official release of jTDS was in 2013, so you'll have to use an unreleased build if you'll be forcing TLS 1.2.