Hi Bret,
For many of the options, it's up to you as the admin to decide. When it comes to delivery purposes, the options I recommend are:
Silent - this ensures unattended install, and will not show up for a user)
No Reboot - just in case... if a reboot is needed, you should let the Policy control the reboot to avoid issues with the policy losing status with the sudden reboot)
All Users - Some installs may require this switch, which is typically an MSI one. I'm not aware if SEP requires this or not.
You can also control this at the command-line if you don't want to take the time to build an installation package. The other benefit of importing from an MSI versus an EXE into our Software Catalog is we will dynamically generate both a detection rule based on the MSI, and a list of command-lines that give you options on the points I describe above.
Regards,
Joel