There's always the option of stopping the services responsible for all of this... sort of.
The whole restart circus is managed by the update orchestrator service if I remember correctly. The problem with these services is that they tend to restart themselves without your permission even if disabled.
There are different ways to prevent it from restarting, although none are 100%. You can disable the service, you can change the service's permissions in the registry so that only you can change the service's status (that way only you can re-enable it - at least theoretically). You can also rename the service's DLL, although I can't guarantee that it won't break anything significant, and you may have to do it with a third-party file browser since explorer may refuse to do it.
And I've even seen Windows 10 recreate the Windows Update service DLL out of thin air.
The services, as far as I know, that manage the whole update process are:
- wuauserv: Windows Update Service
- UsoSvc: Update Orchestrator Service
- WaaSMedicSvc: Windows Update Medic Service
I can't guarantee, though, that there aren't more there - Microsoft seems kind of intent on hiding these services from people wanting control over their computer.
Of course, there are always options like O&O ShutUp10 that can manage this for you.
Finally, the obligatory warning: Whatever you do, don't forget to re-enable all of this stuff at some point, because security updates are important, after all (even though this ended up being a feature update instead).