I can't seem to find this configuration in the User Profile settings.
There is no field-level security for custom settings: access to all custom settings and all the fields in those custom settings is controlled by the "Customize Application" permission.
You can give access to the settings for "Customize Application" users of the installed package via the default "Manage" UI by choosing "public" rather than the default "protected" visibility when you create the settings.
If you do want to introduce field-level security you will have to build that yourself by adding Visualforce/Apex on top of the "protected" custom settings.
We cannot do field level security or sharing with Custom Settings. Public custom settings can be read by everyone. (and apex code can) and protected custom settings and its a managed package, then no one can read the setting (but Apex code running within the namespace can).
Profiles with Customize Application permission can modify a public custom setting. No one can modify a protected custom setting.
For custom settings, apex code within the same namespace will always be able to access them for both read and write. It doesn't matter if the code is with or without sharing (as sharing has nothing to do with custom settings).