My personal opinion:
There is enough trouble to be found in this forum with this setup to just avoid it, if possible.
So in my case … privacy-sensitive or work-related stuff goes into the encrypted Internal Storage, other stuff is on the unencrypted SD card.