I always disable automatic updates as a group policy and re-enable them when I'm ready to install them for this very reason.

You don't even need to reenable. Manually checking for updates still works.