Do not have Windows update set to the Install update automatically (recommended) setting. Then you can veto any updates it wants to install.
I have "Never check for updates (not recommended)" as my setting. I know that Windows releases its main updates on the second Tuesday of every month, and, apart from that, it takes a few seconds to initiate Windows Update to see if it's offering anything. At the maximum setting I would suggest "Check for updates but let me choose whether to download and install them".
The way I look at it is, would you leave your door open for anybody to walk in, or do you bolt it so you can check who walks in?