Hey Paul,
I'm glad the suggestion solves the problem (mostly 😀).
Regarding your follow-up question - those two settings (end user is logged in vs. not logged in) work independent of each other. That is, you can deny or allow access for both scenarios on a per agent level. The example you provided would result in the agent being able to connect to devices where no end user is present, and if there is an end user present, that end user would have to approve the remote session for the agent to connect to the device.
So, you can realize pretty much any client requirement, I dare say. If you don't allow agents to connect for either attended or unattended situation, the connect button and all related buttons will appear as greyed out, as you can see in the screenshot below.
Let me know if you need further assistance, happy to help.
Best,
Daniel