The demand for increased spectral efficiency (SE) in downlink multi-user multiple-input multiple-output (MU-MIMO) systems has led to the development of various multiple access techniques. Among these, rate-splitting multiple access (RSMA) can improve SE over space division multiple access (SDMA) and non-orthogonal multiple access (NOMA) by splitting each user's data into common and private parts. The common parts from all users are then encoded into a single common message, which is transmitted alongside the private messages using an RSMA-specific precoder. Recent results showed that the precoder can be modified to enable physical layer security (PLS) by integrating secrecy rate constraints into the design. However, this approach only secures the private messages, while the common part of each user remains unprotected. To address this limitation, we propose a hybrid-PLS RSMA scheme that symmetrically encrypts all user data and embeds key information within the PLS-secured private messages. Additionally, the RSMA precoder is adapted to ensure that the private messages are sufficiently sized to carry the key information. The precoder design is formulated as a non-convex SE maximization problem and solved using successive convex approximation (SCA). Analytical and numerical evaluations demonstrate that the proposed hybrid-PLS RSMA can significantly improve SE compared to partially secure RSMA and secure SDMA, when complete user data security is required.