I've tried most of the tricks posted out there to lockdown updates and the most effective has been blocking them by DNS. With pihole it's a simple regex blocking MSFT and done. You could use the hosts file though but, it's slot more lines to add vs using a regex / wildcard. Pihole will run on just about anything as it's just an app.