Box for Salesforce is installed and the Box component is configured on the Salesforce Lightning page.
The help below states that Salesforce permissions can control reference and editing, but I am able to create Box folders from Salesforce even if the object permissions in Salesforce are view only.
Box for Salesforce - FAQ – Box Support
What restrictions can an admin place around Salesforce content in Box?
How can I prevent Box folders from being created?