Anything you put in spam.txt will be forbidden. So you can put http:// in there if you want to go so far as to forbid links entirely. I find that adding <a href=" and <a href=' helps a lot if you're dealing with bots that are dumb enough to try and use HTML everywhere.

Disabling auto-linking can't be done from the configuration, you have to edit the code to remove it.