Use the Local Group Policy Editor application, and navigate to Computer Configuration --> Administrative Templates --> Windows Components --> Windows Updates.
In the list pane, disable the following settings:
- Configure Automatic Updates
- Automatic Updates detection frequency
This will keep the machines from updating themselves, even if they have internet access.