Prevent SharePoint Updates from being installed to server?

In Production, Infrastructure downloaded and installed some Server Updates, with additional SharePoint Updates. We're sufficiently up to date and stable, and didn't want to update. We wound up rolling back before running the Config Wizard, but want to prevent this from happening in the future. Is there a way to do this?