Not super strong in this area. What I know for sure is if you include a device with security in Simplicity suite, it will not work in OH with the zwave binding. For a device to work in with OH with the zwave binding it needs to be included with it. Also, as to security, the OH zwave binding only supports the legacy S0 not the newer S2. There are now two security command classes V1 and V2. The OH Zwave binding only supports V1. Some of the newer devices only have the V2 version. Some transition devices may have both Command classes. If your device has V1 it should be able to be included as the spec requires S0 as a fallback. If it only has V2 it probably can’t be included with the OH Zwave binding. I also believe security inclusion must be done within a very short time to be successful.
An alternative is to use zwave-js-ui in OH instead of the OH Zwave binding. I have that working for some of my networks. It is a little more complicated, but they have all the security options (as it seems important to you) including what is needed for Long Range inclusion.