Even if we assume that at any moment you can choose any character - ultimately you need to notify the server of your choice via RPC.
If a check is required to determine whether a player can select a specific character, it must be performed on the server.
There is also a method that I named RPC-tunnel.
For example, when the ability to select a character appears on the level, BP_CharacterSwitcher actors are created for each character, and each client becomes the owner of one of them. Only now will the client be able to honestly change the character.
Then BP_CharacterSwitcher will be deleted, or the client can be deleted as the owner, and it will no longer be able to send RPC to the server.