Can only specific SQL users be forced to use TLS? My school would like to develop custom software for some embedded devices. As part of this, we may need the devices to connect to an SQL Server instance.

Is it possible to force specific SQL users to use encryption when connecting to the server? We don't want to force it for the entire instance because of some important legacy software.

We're also evaluating other (frankly, better) solutions, but I want to know what's possible.
The option for forcing encryption from the server side is either all or nothing.  There is no way on the server side to configure it so that it only forces certain logins or connections to encrypt.

Clients, however, can be configured to either encrypt the connection or not.  For example, adding encrypt=true to a Microsoft JDBC connection string, or SSL=require   to a jTDS connection string will configure that client connection to be encrypted.  If you're using an ODBC DSN, the configuration typically has an option for encryption as well.  You should be able to quickly learn how to configure a given SQL client for encryption by doing a bit of searching on the Internet.

One note of caution is that you may need to update SQL Server and the SQL client that is being used if you are forcing TLS 1.2 (see TLS 1.2 support for Microsoft SQL Server).  The latest release of the jTDS driver has a defect that causes it to fail with TLS 1.2, but there is a developer build available in the forums with a fix.  The last official release of jTDS was in 2013, so you'll have to use an unreleased build if you'll be forcing TLS 1.2.