The server software on macOS Catalina does support encryption, but your client needs to support encryption too.
If you're using a standard VNC client to connect with a password only, nothing is encrypted. Not even the password. In this case I would recommend an SSH tunnel as you propose, or other forms of encryption such as an encrypted VPN, encrypted ...
I am having the same issue. I am logged in with userA. I can see all of the shares. I want to access a specific share that userA does not have access to that userB does. I disconnect from server, but 'connect as' does not do anything when I click it
I found a workaround:
Go to Finder
Click Go, then Connect to Server
Create a path of smb://userB@myserver