You can do this via Group Policy via Computer Configuration –> Administrative Templates –> Windows Components –> Windows Update –> Configure Automatic Updates.
BUT
It seems that Windows Update will still deliver updates if it was previously configured to do so. In other words, this policy only seems to work with freshly built PCs.
My current workaround is to stop the Windows Update service via Group Policy Preferences.