To (nearly) absolutely ensure it's not used unexpectedly, go into Device Manager and disable the device. Re-enable it when you're using it, and only then. This requires admin privileges, so if any malware could do it for you, you're already completely compromised.
A Powershell command can automate this for you. Get-PnpDevice -class Camera | Disable-PnpDevice -AsJob will disable all currently-installed devices with the "Camera" class (including any that were installed but aren't presently connected; add -Present to the first command - before the | - if you only want to affect currently-connected devices). The same command but with Enable-PnpDevice instead will re-enable the devices. The -AsJob parameter prevents the cmdlet from prompting you for confirmation. You can also use -FriendlyName *foo* instead of (or in addition to) to -class Camera to filter devices by their "friendly name" (in this example, the name would have to contain the string "foo", case insensitive); this can be handy if you want to enable or disable only a specific device, or you want to get all "devices" related to a particular piece of hardware (for example, webcams often also have microphones, which are "AudioEndpoint" class devices instead of "Camera" devices, so there will be multiple software "devices" installed for one piece of hardware).
If you want to be (considerably) less careful, just use Win10's built-in Privacy settings to control what apps can access the camera. Settings -> Privacy -> Camera, and turn on or off the apps you care about. It's mostly only for controlling modern "store" apps, though; software that uses the legacy camera interface (which will include most software that is designed to run on pre-Win10 versions of Windows) will not be controlled in that list. An app that is disabled from that list but wants to use the camera will prompt you for permission.
Of course, the main weakness of the first approach (aside from the inconvenience) is that there's no way to control what software can access the webcam while it is enabled. However, there's little you can do about that, beyond restricting Store apps from getting access (as in the second approach). At some point, you need to either trust that your device is not running malicious software, permanently disable the camera, or assume that you might be being monitored (and, of course, if there's untrustworthy software it could do a lot of things beyond access your camera).
It sounds like your AV is alerting every time any program tries to access the camera device at all, regardless of whether it's actually doing anything with it. For example, the YouTube thing is probably just YouTube checking whether, in theory, it would be able to use the "Webcam Capture" feature to record and upload a video. It's not actually requesting access to capture video; if it did, your browser would prompt for whether or not to allow access. However, it might trigger the browser to try opening the webcam device just to see if it's usable, and that may be enough to trigger the alert.
