It's either that or enable SSL/TLS certificate for mail by default on a per domain basis. This tutorial works fine https://support.plesk.com/hc/en-us/articles/115001446174-How-to-secure-a-Plesk-mail-server-with-different-SSL-certificates-SNI-support-
But doing it manually for every new user is...