

CRF 18 is usually where I start at, but that is focusing on quality. I’d imagine you would want a higher starting point.
If you want to find out what different options are or do, the docs are a good place to start: https://x265.readthedocs.io/en/master/cli.html
I would do FDE yeah. My current laptop setup is with systemd-boot and a special initramfs that allows me to unlock it with a yubikey, with fallback to password. Fair warning, this exact configuration is not particularly easy to setup.
There are also modules which enable early network connectivity along with a SSH server, meaning you login and unlock it remotely. I have not tried this.
Debian does not frequently require rebooting under normal circumstances. Kernel updates are not that frequent, and you can usually put it off for a bit if you don’t want to deal with it.