I wish there was a law which mandated update, service and telemetry servers were on different cidrs.

There are frequently updates lists Windows telemetry IPs you can block using ipsets. But a Microsoft always seem to mix these IPs with legitimate services.