With the unmanaged client, the user has full control over it to make changes as they please.
With the managed client and the default policy, the client is in server mode, which means everything is controlled via the policy in SEPM.
Now, with that being said, if you look at the default AV policy, all of the lock icons are open, which means the end user can still make changes so you'll need to decide if this is what you want or you'll need to close those locks they cann't make changes.