No need to worry, it’s in your BIOS under security section. You can check if you set correct one by trying to change boot device: if there’s password prompt, you’re now safe from windows update “repair”.

Just protect bios/uefi with password and windows won’t be able to modify any other EFI entry. It worked when i’ve dual-booted, it should still work.