if by firewall you mean an EXTERNAL firewall (pfSense box or something), sure, but how do you trust the windows firewall? And anyways what if you do want software updates and the telemetry is sent as part of your update request? Unless you have deep packet inspection and drop the telemetry packets how are you going to make sure the data does not go out?