I use Firefox ESR to avoid every little update, but still get security updates. I also set Firefox to notify me about updates, but not install them unless I choose to and only once has Firefox disrespected that setting and pushed something at me without any prompting. If I ever figure out how they pulled that off, I'll do whatever I can to disable that too.