Installing AV can wait on a new machine until you have sysprepped it. Sysprep first, AV thereafter. If you are so concerned that someone or something could get in to a new machine when it first boots after a clean install and machine is not connected to the Internet, then you have bigger problems to worry.
My recommendation to you: unplug the Ethernet cable and disable WiFi when in Audit Mode after installation, that takes care of the security. Sysprep, boot normally, install AV, and only then connect Ethernet and enable WiFi.
Yes, all apps and programs are by default installed on C: drive in Windows. They will be installed on C:\Program Files or C:\Program Files (x86) folders. This method does not relocate those program folders, just the Users and ProgramData folders.