An encrypted tunnel that isn't initiated at the database level should work fine.
Addendum: I'm more than a little puzzled that someone would be aware that a particular nosql database didn't support encryption natively and yet wasn't aware how tunneling works.