Windows Update Blocker (WuB) is great, has CLI to use in scripts, and effectively turns off Windows updates and prevents the dickhead “Windows update medic” or whatever service from re-enabling updates. No need to modify registry or GPO. When you want to check for updates, you just click a button in WuB! I love it and even use it in my VM for work.