How do I generate protected programming files that do not require tethering nor time

We are am currently designing and licensing full featured third party IP, and provide OCP evaluation support though *.ocp files and amplic/ampcrypt tools. We wish to move to an free/premium licensing model as opposed to the evaluation/paid licensing model we are currently using. To do this, we wish to continue to protect any generated netlists including the programming file for "free" licenses, however we want those users to be able to use the IP without restriction. The difference being that "premium" users pay for netlist/timing simulation capabilities.

So, how do we generate protected programming files that do not require tethering nor time out? Is there a particular value for the timeout interval in the ocp file or does the -a option for amplic still generate protected pof/sof?

Thanks for advance for clarifying