We'll activate Office without the user needing to hit the portal itself, but he or she will be able to log in via the browser to access other services. There are means to lock that down via ADFS restrictions to known computer objects in your AD.
Everything except shared computer activation applies to Office 365 Business Premium. You can exclude apps via ODT, binary delta compression for updates is the same, ect.
We announced per-file encryption at rest in May:
Per plan and announcement details above it began rolling out in July and is AES-256.
Mar 10, 2014 at 9:49 PM
You still have the option to purchase and activate Office in the traditional way. You can even build optical media to install Office and use a 5x5 key if you are feeling nostalgic.