Yea consul connect is a good choice for mTLS, it's enforced by default with no way to turn it off.

You can also go DIY with something like Traefik and just configure everything to require TLS with client TLS pass-through for enforced mutual TLS, that puts you into 'require a set of central load balancers' but you still get all the benefits.