I bought 20+ Recertified Class Western Digital WDC H530 14tb's for 126.99$ each from serverpartsdeals.com over the last six months. Comes with a 2 year warranty, which is about what you would expect a drive to have anyways.
I also have a dozen Ironwolf 12tb's (no pro) which have 3yr warranty, but still, if I had new about the recertified drives then I would've been all over those.
Really its about how much space do you need, how many SATA slots can you fill, and your use for them.
Linux has Luks which is very effective, all my machines are encrypted using Linux LUKS, I don't really ever use Windows for encryption I know bitlocker exists but I've read articles on how people can still get access to the drives.
To keep people off certain folders, drives, you would need to setup user or group permissions. I do this in Linux as well, only I have access to the 18+ stuff.
Hardware wise you can find enterprise drives that have encryption built into it. I know some WDC drives have it.
Here is an link to WDC drives that have AES-256 encryption built into it: WDC Drives I would expect them to cost a bit more, but if you really need the protection I would build a machine with Linux as the main OS, and then configure the drives under luks with passwords, hell even a passkey file using random 2048 string can be configured. Run Windows under Virtual Machines, I have a 10/11 VM that can read/write to the drives, but you still need a password to open the VM's.
I'm sure there is a solution for you. Just like I've found one for me.