Encrypted non-root disks, pass-through and luks or zfs-encrypt dataset?

I have an encrypted vm (the dataset the vm is on is encrypted).

I'd like to add two HDDs to the vm and use mergerfs on them, but I'd also like the hdds to be encrypted.

Should I pass-through the disks and then use luks to encrypt the disks, or should I use zfs to encrypt the disks and then hand them to the vm like any other disk?

Zfs looks most enticing, but if there's a huge decrease in performance I'd like to know beforehand.

Any advice? Thanks!