You don't need proftpd to do SFTP, you can do that natively with ssh.
If for some reason you want to use proftpd (i.e. you want to integrated with non-system accounts easier). You'll want to deny access to the login verb for the server, then create a specific virtual host with the sftp engine on and allow the login verb.
To accomplish that your proftpd.conf will look something like this.
<Limit LOGIN>
DenyAll
</Limit>
<VirtualHost 1.2.3.4>
SFTPEngine on
<Limit LOGIN>
AllowAll
</Limit>
<all your other crap...>
</VirtualHost>
You don't need proftpd to do SFTP, you can do that natively with ssh.
If for some reason you want to use proftpd (i.e. you want to integrated with non-system accounts easier). You'll want to deny access to the login verb for the server, then create a specific virtual host with the sftp engine on and allow the login verb.
To accomplish that your proftpd.conf will look something like this.
If you want to do FTPES with proftpd you basically need to follow 4 steps.
1) Install proftpd and openssl
2) Generate a cert (assuming you are going to self sign, make sure to match the common name to the ftp site dns name to make clients complain less)
3) Edit proftpd.conf replace the mod_tls module section of your config with the text below (note the TLSRequired on directive)
4) Restart proftpd
when you only want to allow ftps with proftpd, TLSRequired is the option your are looking for.
What do you mean by sftp? SecureFTP (AKA SSL ftp), or ftp over ssh (AKA sftp)?
For sftp - just run sshd, and do not use any ftp daemon at all.