Hi,
there is the option for it in Settings after loading an image.
It's a policy, unless Microsoft overrides it somehow. It's not as complete as removing the component, but it should suffice to disable realtime scanning which is the biggest performance offender.
Note if disabling in Live mode (C:\Windows already installed), then first disable Tamper Protection in the Windows Settings UI, reboot the machine, then load with NTLite and disable or remove.