You can also set a local group policy to require authorization to install updates on Win10.
However, there are PITAs associated with this as well. MS does not let you "pick and choose" updates, so that method will install the unwanted OS update to get a security update (if you allow one, you get them all). Using the MS catalog to manually download updates is hit or miss as well, since the search engine gets flaky, and you need to know the specifics of your build (MS releases these for every build possible). Iobit's Advanced System Care (even the free version) seems to be able to pull these updates directly for you even with that Group Policy in place. The other PITA is that once a day Windows pops up an entire green screen "Updates are available to install" which locks out the machine until you acknowledge it (then can cancel on the next screen). That screen will pop up at the most inopportune moments even though it is fairly simple to clear out.
Anyway... because of the above I would not suggest that route for a DAW machine, but it is (sorta) available.