1- on the user document the last column select ” Yes” next to the option of Encrypting the Emails after receiving them ” I think it is like this ” and this will encrypt all the incoming emails after coming to the inbox of the executives

2- You can make him an ” Administrator ” only not a ” Full Admin”