TLDR - Yes, Salesforce will log emails that fail as a result of TLS being unavailable; this includes if TLS is unavailable is a result of "Required" being selected in the TLS setting and the outbound server failing to support TLS.
First, might be worth quoting Salesforce's email deliverability setting docs you're referencing:
To configure the email deliverability settings for your organization:
- To specify how Salesforce uses the Transport Layer Security (TLS) protocol for secure email communication for SMTP sessions, choose one
of the following:
Required Verify: Salesforce continues the session only if the remote
server offers TLS, the certificate is signed by a valid certificate
authority, and the common name presented in the certificate matches
the domain or mail exchange to which Salesforce is connected. If any
of these criteria are not met, Salesforce terminates the session
without delivering the email.
Note: If you select a setting other than Preferred (the default setting),
select Restrict TLS to these domains and specify a comma-separated
domain list. The asterisk (*) wildcard is allowed; for example,
*.subdomains.com matches email@example.com and firstname.lastname@example.org (but not email@example.com). If you don't
specify domains, Salesforce uses the TLS setting you specify for all
outbound emails, which may result in emails not being delivered.
Important: If you plan to use Transport Layer Security (TLS) with this connection, enter the host name instead of the IP address. TLS
requires the host name for verifying certificates
Next what you're looking is to know if Salesforce will log the failure in a way that you're able to tell the failure was a result of TLS connection failure. Salesforce logs this is the
EmailBouncedReason field, which is within the Contact & Lead objects.
Next you need to know the email delivery code for a TLS connection error, here's the list of Salesforce's Mail None Delivery (NDR) codes & Pardot's Bounce Codes; Pardot was acquired by Salesforce when it acquired ExactTarget. You'll notice that none of these code explicitly list TLS failure as an explanation, but it appears likely that a failure would be coded as "451 The command has been aborted due to a server error. Not your fault."
To get a report of the contacts that bounced, see "How can I get a list of contacts whose email message bounced?"
If you want to confirm this, you'll have to setup or find a external system were TLS is not supported, but were the service is valid; which you can check using free online tools like CheckTLS or SSL-Tools. If possible, given security made the request, beyond you confirm that you "checked a box" - ask them if they will supply a way to confirm Salesforce is really enforcing that "checked a box" - since it's always possible they're not (aka "goto fail").