What are you guys recommending to reduce incident energy levels on fire pump controllers fed directly from the secondary side of utility transformers?

Can't be done. This is a common practice but is very illegal in most cases. NEC is very specific in that overload protection (ie, overload relay) is eliminated and short circuit protection only remains. I have no idea why and I've had multiple fire marshals actually try to tell me that fire pumps get ZERO protection which is utterly false. In most cases the short circuit protection on the primary side is NOT sufficient to protect the branch circuit on the secondary side. And that's the answer to your problem...short circuit protection (e.g. a MCP aka magnetic-only circuit breaker or simply a fuse) with the instantaneous trip point set below the arcing current fixes the problem and is 100% legal, and in most cases such as what you describe where it's a huge Code violation, it also fixes that issue.

What if we had a transformer differential relay with CTs on the transformer primary and CTs on the load side of the LV main breaker? The entire fire pump controller would be in the zone of protection. The differential pickup could be set above the locked rotor amps of the fire pump.

Not quite. To begin with the motor current doesn't matter. The differential relay only looks between the CT's (in - out < threshold value) so the zone only extends from CT to CT. As the motor current no matter what it is is outside of the zone, it does not affect the response of the differential relay. You could put the second set in the motor branch wiring which would be silly but would achieve the intended goal, if installed as secondary protection in conjunction with the existing primary side protection. I know it seems like the second set of CT's should be doing SOMETHING useful, even just basic 50/51 relaying, but 87 relays don't traditionally do that. A simpler solution if you are going this far is to simply install the system as described but trip based on simple 50/51 protection on the primary and secondary sides of the transformer and bushing CT's could be mounted inside the transformer compartment directly on the bushings eliminating arc flash except in the tiny zone on the bushing itself, although some creativity could also use this for 87 (differential) relaying over the transformer itself eliminating this zone, too.

Another strike against 87 relaying is that for some reason it tends to be very expensive and the price is over and above the cost of the extra set of CT's and the wiring associated with it. The 87 relays I've priced out in the past have been very expensive which is the primary driver for not recommending 87 relaying on transformers under 10 MVA. Although with sudden pressure rise valves, that's the threshold that most insurance carriers begin requesting more exotic transformer protection.

Not that it can't be done or that cost is necessarily an issue but most of the fire pumps I've seen, especially those that are fed from a pole mounted transformer with primary protection only, run around 25-100 HP and that's it. The customer often listens to the local fire marshal and even questions something as simple as a fused lockable disconnect switch ahead of the starter. despite the fact that the secondary fuses are Code required to achieve the required level of short circuit protection without tripping out on transformer inrush and the fact that the disconnect is OSHA mandatory for a lockout point. That sort of customer probably isn't interested in springing for the kind of protection that you typically see in 15 kV+ double ended substations with redundant 10+ MVA transformers, where spending another $10K on instrumentation is buried in a line item in the budget.

Why not put differential protection around the pump motor? See https://www.gegridsolutions.com/multilin/family/motors/principles3.htm.

You'll need a motor with all the leads brought out as shown. If you wanted a wider zone of protection, use individual rather than summation CTs, and put one set closer to the transformer.

"Differential motor protection" is nothing more than ground fault protection. I'm not sure why GE feels the urge to rename it except for marketing reasons.

Under normal operation, Ia+Ib+Ic should vectorially sum CLOSE to zero. There will be some zero sequence current flowing capacitively to ground, let's call it Ig. Thus a line-to-ground (zero sequence) fault is Ia+Ib+Ic-Ig = Ifault. Line-to-line faults will give rise to negative sequence currents if working in sequence currents but as this confuses electricians I prefer to simply use phase current imbalance instead. Differential detection will NOT detect phase-to-phase faults because obviously Ia+Ib+Ic=Ig even though Ia, Ib, and Ic are no longer equal.

There are two methods for detecting ground faults. The first called "residual detection" either ties one leg of all 3 phase CT's to a common point and then measures current via CT #4 there or equivalently to digitize the three phase currents and do the vector addition digitally, or else to put in a CT with a large window that all 3 phases pass through to measure ground fault current directly. The latter has lower measurement errors and is the preferred solution if you don't mind the extra cost.

Either way, this is ground fault protection. GE appears to be changing the term here for marketing purposes.

Look again. The link I provided does not show a ground fault residual protection, it is true per phase differential. You have three phases coming in, and three phases returning. Igreen+=Igreen-, else trip; etc. The graphic indicates a fault between phases, something that ground fault protection relay will not sense.

Understand that leads connect into wye or delta somewhere off to the left of the diagram.

For a wider zone of protection, use six CTs rather than the three summation CTs shown.

That would be a motor with all 12 leads brought out, or wiring the two coils per phase in series to make it a 6 lead configuration. Most motors are sold in either a 3 lead or 9 lead (dual voltage) arrangement so the price will be a little higher for a new motor although the rewind shop probably won't charge any different. Obviously there are only 3 leads coming into the starter so with the 6 leads just upstream of the CT's the "return" leads can be either terminated at a point in a wye configuration, or else wired to the other phases in a delta configuration.

Phase to phase faults within the motor show up as a zero sequence or negative sequence current. Current imbalance which only looks at current magnitudes should not exceed 10% although it cannot distinguish between a voltage supply imbalance and a problem within the motor. Negative sequence current uses the vector quantities and works much better and is immune to grounding issues, and can work with just a standard motor wiring arrangement without bringing all 6 leads out to terminate the delta/wye externally.

Pure phase to phase faults are equal parts positive and negative sequence current. Phase to phase to ground faults would include a zero sequence component. But differential protection doesn't care about sequence components or source voltage imbalance. If imbalanced voltage causes imbalanced current, the imbalance shows up equally on the supply and return and will not cause the differential relay to trip. As the link states, there are some sources of false differential current; such as starting current, CT error, and CT saturation. All of these can be mitigated.