Encrypted directory queries — LDAP wrapped in TLS from the first byte, in the same way HTTPS relates to HTTP. It is the safe counterpart to port 389, and what any directory bind crossing a network should use.
Encryption alone is not access control — a directory reachable from the internet is still an inventory of your staff. Keep it internal.
Fine on an internal directory server. If it is reachable from the internet, encryption does not make that exposure acceptable.
The port scanner will tell you whether 636 is reachable on a host you control. Checking from outside your own network matters: a port can be open on the machine and still be blocked at the firewall, and it is the view from the internet that decides whether anyone else can reach it.
Only scan hosts you own or have permission to test.