Sorry Dave, I’m afraid I can’t do that! PCs refuse to shut down after Microsoft patch
(www.theregister.com)
You can also set a group policy to allow no updates at all except when you approve and download them manually.
Ridiculous that you need the group policy manager for the basic setting of "don't put shit on my PC without asking," but here we are.