On the clients tab go to a specific group and then click on the policies tab. Go down to where the policies are listed and click the (+) next to 'Location-specific Settings:'. Click on 'Server Control' then choose customize. Uncheck 'Allow users to enable and disable Network Threat Protection'.
You have to have that policy turned off. If you want desktop support to be able to disable it just have them use 'stop -smc' in the Run box. The password can be set under 'general settings' on the 'security settings' tab.
Sutton