How does Windows Defender for Mac block applications and how can people evade the block?

How does Windows Defender for Mac block applications and how can people evade the block?

I am using MS Defender for Mac to specify a list of unwanted applications on the managed devices in my company. I am concerned that some users try to evade the detection by altering the binaries of the files.

Let's pick a (dumb) example: Assume, the Brave browser is classified as an unwanted application. How could or would a user be able to alter the binary to evade detection?