Microsoft 365 Sensitivity Labels Hybrid

Question

My environment is Exchange hybrid and I have the below requirements which I believe all of them can be satisfied by using O365 sensitivity labels:

1. Content Marking
2. Documents/Emails classification or labeling
3. Apply protection actions like encrypt the files or allow only certain group of users to access the file which is labeled

However, as I mentioned that I'm using Exchange hybrid. So I'm wondering how could my on-premise mailbox use the O365 sensitivity label? I can see something called RMS connector which we can install it on Exchange 2016/2019 servers. But does it require the on-prem users to have certain O365 security/compliance license? Or we can just simply deploy O365 sentivity label, install the connector in our on-prem Exchange servers and all good without taking care of the O365 licensing for on-prem users?