Sometimes the "important updates" might still go through metered WiFi. If your computer can stand it, just let it run the "important updates" over weekend or night.

If you really want to stop all update, NetLimiter (paid software) might help to prevent Windows Update from accessing internet. Firewalls are usually insufficient (from my experience).