I'm not 100% sure if NTLM supports SNC encryption or not. I am researching this for you and will let you know what I find. If you used Kerberos instead of NTLM then I know for sure that session encryption is possible and widely used.
If it is possible to use NTLM with encryption, and you have enabled encryption in saplogon.ini and in the snc/ instance profile parameters on the app server, then the session will be encrypted after the user has logged on. If you want to logon with SAP user and password and still use NTLM, then you can configure that in saplogon.ini or right click the entry in SAP Logon and select the option to logon without SSO.