Ok, another proposal.

.onion urls won't work unless you use TOR, so that option should be a general "Allow use of TOR"

Group stuff:
Relays: Use TOR for all relays, untrusted relays, all but DM relays (DM relays are the ones where you have to login to DM?)
Media: Use TOR for all text and media, text/audio/images, text only