I am the IT guy for a small company and Paint.NET + a plugin pack that I compiled get deployed to our systems automatically. They get deployed as a different account from the primary computer user, so a per user scoping would mean needing an extra login script or special instructions if someone needs HEIC to use this plugin.
From the scopes you listed, I think SystemWideWithCurrentUserOverride would make the most sense because plugins aren't user specific. If someone needed built-in HEIC support for some reason, they could still override the system default.