The circle implies "default setting".
So a tick with a circle means that the user has "default access on". A tick without a circle means "they have been given access specifically".
You'll also see an icon with a tick, circle, and people. This means he has default access via a group he is assigned to.
So in other words the icon shows not just access or no access, but also "default access" and then shows what that default access is.