You can nobble it thoroughly, but the mysterious "dmwappushservice" thing might unknobble it for you. (I do this with a script for LTSB, but here's the basics, may include some other things you don't need.)
1 - knobble some tasks.
"Maintenance Install" #UpdateOrchestrator Windows Update?
"Policy Install" # UpdateOrchestrator Windows Update?
"Reboot" # UpdateOrchestrator Windows Update?
"Refresh Settings" # UpdateOrchestrator Windows Update?
"Resume On Boot" # UpdateOrchestrator Windows Update?
"Schedule Retry Scan" # UpdateOrchestrator not present??
"Schedule Scan" # UpdateOrchestrator Windows Update?
"USO_UxBroker_Display" # UpdateOrchestrator Windows Update?
"USO_UxBroker_ReadyToReboot" # UpdateOrchestrator Windows Update?
"Automatic App Update" # Windows Update
"Scheduled Start" # Windows Update
"sih" # Windows Update
"sihboot" # Windows Update - SYSPREP breaks if this is disabled.
2 - knobble some services
"BITS" # Background Intelligent Transfer Service (HTTP)
"DoSvc" # Delivery Optimization
"wuauserv" # Windows Update
3 - Use GPEDIT to tell it where to get its updates from:
Under computer > administrative settings > windows components > windows update
specify intranet microsoft update service location (usually for WSUS)
enable this, give it a bad location like http://localhost:8530/
also enable
do not connect to any windows update internet locations.
In testing, this never tried to update for over a month running test contents but of course, retail versions might do something stupid.
In short, UpdateOrchestrator is your enemy.