Who do you want to keep your location secret from?
If it's an app developer, check the app's permissions before installing, and if you don't think it needs location access don't install it. If you are running Android 6 (or are running 4.3-5.X and install an App Ops app - root needed from 4.4 onwards) you can deny a particular app access to location permissions.
If it's your carrier, put it in airplane mode - if you have a cellular connection then they by definition know roughly where you are (because they can tell what cell you are connected to).
If it's your country's security services, who knows? Best bet is to not carry the phone
As for the last question, any app that has the permission to change system settings could override your disabling of location services. I don't know whether Marshmallow allows you to disable that permission for an app, because my own phone isn't running that Marshmallow. The defence against this is not to install an app with that permission unless you trust the developer - if you install an app that has the permission to change system settings then the OS will let it do that, because the implication of your installing it is that you want it to have that capability. But by the same token you should always ask the questions "do I trust the developer" and "does the app need to be able to do this" about any app before installing it. People don't, but they should.