No need to worry, it’s in your BIOS under security section. You can check if you set correct one by trying to change boot device: if there’s password prompt, you’re now safe from windows update “repair”.

That’s right, i’ve mixed two topics. Thanks for pointing that out

I vote for maddy, but one important note for my setup: my family uses always-on VPN, so i only open port 25 for the world. Imap can be accessed only from vpn. In such case server can’t be used as relay from internet. Maybe try that way?

Just protect bios/uefi with password and windows won’t be able to modify any other EFI entry. It worked when i’ve dual-booted, it should still work.