Two different protections exist and HR should decide which one they mean.

Option one, password on the PDF itself. If the letters are generated from Word, Word does this free: File, Save As, PDF, click the Options button in the save dialog and tick Encrypt the document with a password. The PDF then demands the password wherever it travels. Share the password over a different channel than email, a text message or a phone call, otherwise the protection is theatre.

Option two, encrypt the whole email. On a Microsoft 365 subscription, compose the message, Options tab, Encrypt, choose Encrypt-Only or Do Not Forward. The recipient authenticates to read the message and every attachment inside it. No passwords to manage, but external recipients go through a verification code step which some find confusing.

For recurring salary letters at volume, option one from Word plus a standing password policy per employee is the usual setup because it needs no subscription features and works with any recipient mail system.