Third party DLP solutions like endpoint protector can do this. I have an enhancement request filed with Apple for the ability to enter a configuration profile that lets you set a read-only restriction unless the volume is FV2 encrypted.

Would be happy if you would dupe the request if you have Enterprise OS support contract or a developer account. :)