How do I disable Automatic Update for Windows Update

You are an idiot! Pure and simple. Someone who, without the full facts at their disposal, makes judgements and then pontificates on a tangent that clearly benefits no one but their own ego. Idiot idiot idiot.

my surface downloads an up-date that then prevents it from accessing the Internet. I have removed the up-date several time only for it to be downloaded automatically again. 

So, your idiot ramblings about viruses are intact, the responses of an idiot. I am hardly likely to download a virus if I can't access the Internet. Idiot, idiot, idiot.

When did I tell you that you were wrong or anything was your fault?

But I'll tell you this:  if you didn't get the security update, and you get your financial accounts hacked because you didn't have the update, would you come back saying "why can't my surface just update so I don't have to worry bout this stuff?"  Or if you have a blue screen or your WiFi doesn't work or whatever problem the update was supposed to fix, but you didn't get it, the user would be right back here complaining about it.  It's damned if we do and damned if we don't.

Do you think some programmer here specifically thought "man, users will just ignore the update forever so I have to program a timer.". No, they put you in control.  The default is "install at 3:00 AM" because they hope that when you wake up in the morning, everything is done and you are always protected.  They even spent millions developing a background restart management system that saves the state of your work so it can reboot, but then automatically bring back up the same programs and files in the same place so you don't even "feel" the reboot (many times people don't even know it happened).  That's remarkable and is the type of update experience people have been asking for for decades.

Seriously, passionate people spent years of their lives trying to build a good product and do right by you, the user. I understand you're frustrated, but at least try to understand that they aren't trying to intentionally make you angry. No one sat down and brainstormed about how to best irritate a user.

And for what it's worth, my Samsung Galaxy phone automatically reboots for updates.

You get 3 days of warning before it gives up and assumes "well the user hasn't touched me in 3 days, I'm probably sitting in a drawer and might as well get these critical updates so I don't crash or have security vulnerabilities".

The warning even tells you "if you ignore this, updates will happen automatically in 3 days."

How much longer should the timer be?

Yes, you can disable the automatic updates, there's a simple registry tweak to disable/enable them.