At least you could kill or permanently disable the updater service via services.msc and it would honor your request. Sometimes an update for that service would come out and reactivate it but that was a rare occurrence.