FieVault can automatically be enabled during setup and key held in Intune, you can also set a recovery options key which I would recommend.

You can use FileVault to encrypt removable media, not sure now it could be done automatically from Intune, but worst case you could use a script.,