I think either of these solutions would be ok. I would lean towards the generalisation, so users are still guided through the process of flagging and encouraged to do it - which is an important feature of internal communities who need to catch confidential information as quickly as possible.
Yes, we have a section in our confidentiality guidelines which demonstrates this. Users must read the confidentiality guidelines to gain topic creation permissions.
I also added this at the bottom of our “lessons learned” template:
Confidentiality Reminder
If you see something that you think might breach confidentiality or other requirements, simply flag it, describe what you think should be modified or removed and we’ll take a look.
I can’t give you a concrete number, but before it soft-locked I think we had about 10% of users going through the tutorial. Might even have been more. That was with zero promotion or encouragement of the functionality on our side.