All around, for everything, I cannot recommend the Chris Titus (and friends) WinUtil enough:

https://github.com/ChrisTitusTech/winutil

It's a suite of powershell scripts and tweaks that are open source for inspection frontended by a nifty powershell multi tabbed TUI (Text User Interface) widget.

There's a tab for upgrades and installs of common dev / tech / power user tools; a tab for tweaks; a tab for windows update options; a tab for building install disks / VM's (eg: minimal for gaming or for hosting windows applications in Qubes, etc).

Update Tab can select all updates / only critical / none ever / advise and let you choose.

To use, you do need to 'trust' (or inspect the work of and download source and self apply) a pool of windows tech nerds - you literally open a powershell admin window and pipe raw boot script over the internet and give it control to bring up the TUI.

This could be malware (but isn't, last I checked) - same risk with all such tools d/loaded from internet of course.

See Usage on github page - various writeups and youtube tutorials.

It'll rip the AI addons, Copilot, and Snapshot and Spy stuff right out of Windows 10 / 11.

Easy to use and follow.

This one not only blocks OTB update but lets you cherry-pick whatever is available afterward. From the creator of Sandboxie, another must have tool.

https://github.com/DavidXanatos/wumgr

Go to system32 and take ownership of wuaeng.dll and qmgr.dll and restrict access to only your user. Works on 10 and 11.

Windows will chug along as if Windows Update never existed (forever).

I have this one https://www.sordum.org/9470/windows-update-blocker-v1-8/

I will check out the Chris Titus link someone else posted below, too, but that seems more risky.

I think it's Windows Update Blocker:

https://www.sordum.org/downloads/?st-windows-update-blocker

Isn't it microsoft who blocks updates after it discontinued windows 10?