Istio IngressGateway mTLS only for select paths

Is there a way to configure Istio Ingress gateway such that some subset of paths require TLS (no client certificate) but rest need mTLS (client certificate required)?

Currently I see configuration of ingressgateway allows configuring tls Mode to be simple or mutual. How do I get a server to be configured with mTLS by default except for a couple of routes?