I've never really understood this mindset. Browsers are big 'ol security holes, you want to shovel as many of the latest security updates into them as quickly as possible. Surely the risk of you getting owned by a patched exploit because you forgot to update outweighs most concerns?
Not to mention you can turn them off in the preferences.
You can turn those off. Options > Advanced > Update > Check Never
Alternatively, he could switch to the Extended Support Release (ESR) channel -- which BTW I've been using happily for years. The ESR channel gets security updates, but otherwise updates itself only once a year: