Hi David,
Thank you for the post. To my knowledge, if you'd like to enable the advanced data governance feature in your entire tenant, all users need have E5 or add-on licenses. Though normal users won't access Security and Compliance admin center, the feature should be enabled for the user accounts.
For instance, if you disable the Teams license for a user, then this user cannot access Teams. And all the configuration in Teams admin center is nothing to do with this user, that is, the settings or policy you set up in Teams admin center won't apply to this user. Also, you cannot see any Teams activities of this user in Teams admin center because the Teams feature is not enabled for this user account.
Regards,
Marvin