at least in my experience, setting it through group policy so that it will not download patches without user interaction works. without downloaded patches it also won't install any automatically.