Can Dispel enter our network whenever they want?

No. Dispel's remote support tunnel requires you to proactively grant access during each support session, so nobody can enter your network without your explicit permission.