IOMMUs are designed to prevent peripherals accessing all of memory, so you don't need to disable DMA.

If a device did manage to escape the confines of the IOMMU somehow, then it would likely just get the encrypted pages, which would be garbage without the keys to decrypt them.