If you just want to block users from disabling AV alone, You can Just click on the Lock option on the Policies.(As explained in the above mentioned doc posted by Vikram )
If you lock AV options alone, When you right click on the client icon on the system tray, "Disable option" will not be grayed out.
But when user selects the option only Network Threat Protection will be disabled.