Ask HN: What's the best way to do filesystem encryption on macOS?

Hello internet!

What's the best way of having filesystems that are 1) encrypted, 2) mounted on demand (not all the time).

Contenders are 1) encrypted disk image, 2) encrypted APFS volume, 3) 3rd party solution (which one?).

Which one is the best and why?

Thanks!