For a complete migration of your exchange to Microsoft Exchange Online, you do not need to change your configuration. TLS is enabled by default for all emails as long as they are using a windows machine. Microsoft assigns a public certificate which is accepted by all the clients in Windows OS and so all you need is a Mail Transport Agent like MS Outlook or Thunderbird.
For a Co-existence scenario where some users are on local exchange server and some are on Exchange Online, you need to install a TLS Certificate and enable TLS in your Bridgehead Server which directs all your email traffic.
For more information, visit Microsoft Technet: http://www.microsoft.com/online/help/en-us/helphowto/ad854daa-75aa-4fc7-bb1d-86e7bc8cfcf1.htm