These are my favorite two DENY rules on my PiHole blacklist:
(\.|^)apple\.com$
(\.|^)icloud\.com$
Also, set your Mac's `do not disturb` feature to turn on at 3:01AM, off at 3:00AM == no more notifications
You can then download OS updates directly from Apple's CDN via https://mrmacintosh.com/