Hi,
Yes, normally, it is OK to let it have access. There can be several instances of it running at the same time.
It is one of the file that trojans target, hence the ‘normally’.
Here’s a quote from Microsoft
The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging.
Rik