NetWorker does provide the ability to do encryption, but this can only be done by NetWorker at 'save' time (when the backup is originally created), and not at 'clone' time (when a copy of an existing backup is made).
If you have backups that weren't created using NetWorker's encryption machinery, your other options include:
put an encyption device inline between the clone storage node and the target device
write to a target device that supports encryption (ex., IBM LTO4)
Note that these options provide encryption that is outside of NetWorker's control or knowledge.