The behaviour you are experiencing is normal. User Profile configuration has nothing to do with the people picker performing look-in in Active Directory.
One very simple configuration you could do to restrict that is to use STSADM, as example
stsadm -o setsiteuseraccountdirectorypath -path "ou=OUPath,dc=domain,dc=com" -url http://MySite/sites/MySubSite
or for the Users part of the Site Collection only use
stsadm -o setproperty -pn peoplepicker-onlysearchwithinsitecollection-url http://siteCollectionUrl -pv yes
More on this is explained here http://technet.microsoft.com/en-us/library/gg602075.aspx