Due your need (keep W2003 hosts), you need to keep agents with old levels of TLS.
But you can configure Apache with more than one url using 'VirtualHost', and if Apache is 2.4.42 or upper with SSLProtocols differents = different level of TLS.
So you can have an url for old agents with TLS1, and another url for new agents with TLS 1.2. (Agent settings means differents 'Server' settings !)
For downloading OCS packages, agents will use https for 'info' file and http for 'fragments' files. (Also when you create a package, you have only the choice of HTTP !). So I'm not sure, it's possible to have only HTTPS.
Therefore when you use https, you need certificate, and you have to consider how renew the certificate and also deploy new certificate : IMHO I prefer SSL=0 ...