You can disable automatic kernel updates on almost every distribution. Most people that use secure boot and Nvidia do it.

I wouldn't know. I run Gentoo. :)