I don't want to disable updates (which is currently the only option I can set via policy) because I need to be able to manually check for updates but I don't want to automatically check for updates (yes, I'm aware they don't automatically install). Is this something that will be supported via policy in the future?

Also, are there any workarounds (other than creating a firewall rule to block the checks)?