Is support for unauthenticated TLS connections necessary?

Is support for unauthenticated TLS connections necessary for conformance to the spec?  We do not want to allow unauthenticated client connections to our server, i.e. without client TLS certificates  Section 3.1 of the Profiles doc reads, "This authentication set stipulates that a KMIP client and server SHALL use TLS to negotiate a mutually-authenticated connection with the exception of the Query operation. The query operation SHALL NOT require the client to provide assurance of its authenticity." This tells me that support for unauthenticated connections *is* required.  However, in section 4.24 of the Specification doc, "The Query operation SHOULD be invocable by unauthenticated clients to interrogate server features and functions." Reading, "SHOULD" and not, "MUST", this tells me that support for unauthenticated connections is *not* required.  Can we refuse unauthenticated connections and still conform to the spec?  Regards, Jim Flood