I never upgraded to the full 4.3 firmware, so I'm free to flash any ROM and GSM modem as long as I don't flash the 4.3 or 4.4 LTE modems. Those LTE modems are tied to KNOX and render your phone basically useless if you don't flash the full firmware. But, even if you do flash the full firmware with KNOX, you can still root and flash recovery. The consequence is that the KNOX counter will be tripped and Samsung or T-Mobile will take note of this if the device is ever returned for repair or replacement because tripping KNOX voids your warranty.
KNOX doesn't prevent root or lock your bootloader. Because I never upgraded to KNOX enabled firmware, I can still send my device back at no cost to myself for a warranty claim if I ever need to do so.