ML algorithms for defining NORMAL user behavior
I think it depends mostly on how difficult/expensive/time-consuming it is to gather data for abnormal behavior.It also depends on whether you'd expect this abnormal behavior to belong to one (or a fixed number of) classes or it could be anything that deviates from normal. 

If you can afford to collect labelled data and expect the abnormal behavior to be limited to a fixed number of classes, then the supervised approach is very likely going to give you better results.

Instead, if any of the above hypothesis do not hold, then I think the semi-supervised approach (as you said, One Class SVM or similar techniques) is in my opinion a good way to go.