That's default Windows behavior. If AD grants access to the web site on your QlikView server to all Domain Users, then every authenticated user is able to open/view the AccessPoint. Moreover, if SSO has been enabled, no questions will be asked.
In default authentication mode, the AccessPoint is just a web server that isn't even governed by "QlikView". What can be controlled by the QMC is the set of documents that are displayed in the AccessPoint. And in the end, anyone without a QlikView license will never be able to open a QlikView document in the AccessPoint, even though a thumbnail might be displayed in the overview.