Hi Chris. I want to make sure I understand what you are asking. Are you saying your want TLS and non-TLS on the same ports? If yes, then yes, this is actually how TLS is usually set up. 

You would set up 25, 110, 143 and 587 with TLS and an SSL certificate. Let's say that your SSL cert covers only the domain mail.example.com. When your users are waiting to use SSL/TLS, they would need to use mail.example.com as their incoming and outgoing host names in their mail client such as Outlook with the TLS ports. If they want unsecure (non-SSL/TLS) they would use their own host name, for example, mail.customerdomain.com with the same ports that TLS uses and that would give them an unsecure connection. I hope this helps. Please let me know if I am understanding you correctly. Thanks!