Do we need to move our entire IT environment into the enclave?

No. Only systems, users, and data involved in handling CUI need to be included in the enclave. Your remaining IT environment can continue operating as normal.