That's why you get Windows 10 Pro instead of Windows 10 Home.
I now have my render box completely disconnected from the internet and I task it remotely.
Specifically, in group policy:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > "Configure Automatic Updates" and "No auto-restart with logged-on users for scheduled automatic update installations"