[Samba] LDAPS , TLS

[E R]

The wiki has a page
https://wiki.samba.org/index.php/Configuring_LDAP_over_SSL_(LDAPS)_on_a_Samba_AD_DC
that discusses LDAPS but I am going to assume this only applies if using
Samba as a domain controller?  I also see there is a setting for "tls
enabled" in the smb.conf file as well along with some other settings for
configuring TLS.  Can/should any of these be used when using "security =
ads"?

As I understand it "security = ads" uses Kerberos so I am inclined to say
"no".  But when I noticed the setting for "winbind rpc only" says LDAP is
used first this makes me wonder if I might be using unsecure LDAP in some
scenario.