I would go with a main switch (some get a keyed switch to prevent anyone from turning it on) wired to a contactor, so that when you turn it off the switch itself is the only thing energized in the panel. Then, yes, each element would have a switch wired to a contactor between the SSR and the element, so you could turn each one on and off individually. This is similar to Kal's design, except rather than having a 3-way switch that turns on either element but not both, you would have a 2-way switch for each element.
Again, having a contactor between the SSR and the element makes sure that when you turn the switch for the element off, that it is really off, regardless of what the PID is signaling. When the switch is on, there may or may not be current to the element, based upon what the PID is signalling (leakage aside). An easy way to think about it is that when you turn the switch on, you are giving control of the element to the PID and SSR. When it is off you are taking it away, so the element is off.