we allow customers to secure message us stop payments requests. we then secure message the disclosures for them to say they have read (they say by replying by secure message)
are we done then, or do we need to take the information and fill out a stop payment request form and attach the secure message?

You're asking a question related to the way in which your bank gets a stop payment recorded on its system. If all you have is a pair of messages, I don't see that the stop has been entered. However you get the entry posted to your system, once that's done, you're done. Keep the messages to document the action.