Computer Config\Policies\Admin Templates\Windows Components\Windows Update\Do not connect to any Windows Update Internet Locations

We set this to enable but, as it says, it has the knock on effect that no one can download apps from the Windows Store when enabled. But we enabled this because via the Windows Store you can bypass WSUS and install Windows updates. Which someone did back when an old build of Windows 10 was released that was bricking machines. Lucky the 3 users that had managed to install it, via the Windows Store, were OK but had to rebuild their machines after.