The circle implies "default setting".
So a tick with a circle means that the user has "default access on". A tick without a circle means "they have been given access specifically".
You'll also see an icon with a tick, circle, and people. This means he has default access via a group he is assigned to.
So in other words the icon shows not just access or no access, but also "default access" and then shows what that default access is.
Cheers
Bruce