The override > keep custom avatar option has to do if they are in a usergroup that has avatar permissions and are then moved to a usergroup that does NOT have permissions, then are they allowed to keep the avatar. If you don't want them to, then set it to No. If you do want them to keep it, set it to Yes. What you want to do is set it to No and then change their Primary Usergroup to one that does not have avatar uploading permissions.