I'd also recommend looking into Bedrock, as it neatly sets you up for updating via Composer, which is quite nice once you get used to it. Good thing to fire off on a post-deploy hook. Then you can completely disable any internal updates and completely control the version of core and plugins.

The folder structure also adds some minor security through obscurity.

There are other niceties in there too.