Glad that I came across an expert like you!!!!
To summarize:
1. Create a Encryption Key at the OS level
2. Encrypt the database, better to do it before the data Migration, right after the Installation
3. Make sure that the Encryption key is secured, no one messes with it
4. In order to change the Key shutdown the database and change the key
This does not prevent any user(be it inside SAP Application or Hana database) from running any Native SQL or Hana Studio.
In order to start the DB, make sure that the key is there. Same is true for the Shutdown.