...stop the "Windows Update" service (wuauserv). One can use services.msc for this, or any number of command-line tools such as "net stop wuauserv".

Note that unless the service's start type is also set to disabled, the service may again be started (e.g., if Windows Media Player is launched); at that point, one would need to stop it again. One could disable the wuauserv service after downloading and installing the updates (e.g. "sc config wuauserv start= disabled), and then add a script or scheduled task to run when they log in, that restores the start type to auto ("sc config wuauserv start= auto"), to ensure that the service doesn't again start up when it is not desirable to have it do so.