You can’t use let’s encrypt. They will need to supply certs on their reverse proxy.
They should provide an email server that will remove your ip from the email headers, but really, leaking your ip isn’t a problem if you firewall access to your server and allow access only from their server.