After skipping through this post I feel like you are missing some essential understanding of the feature @fmonts. Please do read our official guide on this thoroughly.
Regarding making the TLS encryption optional: It is.
However we feel it is very important to point users to this feature, as it greatly improves security of the transmitted data. Firewall rules do not replace encryption, because everyone can still read the data in transit.
Of course you could use SSH to call the agent, which in turn would provide equivalent encryption.
And as already pointed out: You can simply disable the warning. However, we do not recommend that.