RMS Connector Exchange onprem

Hello

We are in a hybrid environment. Users are sync'd using azure ad connect. On-prem users can successfully send encrypted emails to Exchange online users. However Exchange on-prem users cannot successfully send encrypted emails to exchange online users that are in a different org\tenant.  For this to work do i need to install the RMS connector onprem ? Also how do on-prem users get access to use sensitivity labels ? All users have the appropriate O365 license.