Veracrypt. You create a container on the pendrive, pass the password via some other means, and on opening you can use it as a normal drive. It re-encrypts on closing the drive. The downside is that to create a container on, say, 126GB drive it takes quite a while, so this would only be of use if there aren't many pendrives in use.
https://securityinabox.org/en/guide/veracrypt/mac/