Is there any action that you can perform on the WSUS Server to stop it pushing that update to just one machine? I don't use WSUS myself so you might need some help from someone that does.
Any clues in these?
Computer not taking Windows Update - want to tell WSUS to stop
WSUS Forum
https://social.technet.microsoft.com/Forums/windowsserver/en-us/home?forum=winserverwsus
The problem is not a WSUS issue; it's a client issue.
In answer to your question, there are ways to keep the client from being offered the update but the update will always show up as needed in WSUS.
I just declined the update based on a statement from Lawrence Garvin in another thread (I don't have the link any more). He suggested that any Windows Defender update over several days old could be declined because it is replaced. I disagree with that because it is less seldom than a few days before Microsoft publishes major accumulative Windows Defenders updates - assuming that those 100+ MB updates are accumulative. But, eventually, I hope Mr. Garvin is right, the updates get built into later updates and it is safe to decline Windows Defender updates even if they haven't been officially superseded.
This is a flaw in Windows Defender updates that Microsoft continues to ignore. I can understand, to a point. These updates happen so often that going back to every previous one to fix issues could be quite costly and time-consuming. I just wish they'd own up and tell us, yea or nay, if we can simply and safely ignore the update.