Microsoft is making it harder and harder for users to decide if and when they want to search for and install Windows Updates, assuming the average user is not intelligent enough to make such a decision for themselves.
To disable Windows Update completely execute the following commands in an Administrator Command Prompt.
Update 2018-02-11: Looks like Windows Update can no longer be completely disabled. The methods described in this article help to keep it off for a little while, but it will eventually come back. At this point in time it is unknown if and how Windows Update can be completely disabled.
Some of these commands need Microsoft’s SysInternals which can be downloaded from here, then add these to your Path environment variable (alternatively substitute “psexec” with the full path to “psexec.exe” in the following commands).
net stop wuauserv
sc config wuauserv start= disable
psexec -i -d -s schtasks /change /tn "microsoft\windows\updateorchestrator\schedule scan" /disable
psexec -i -d -s schtasks /change /tn "microsoft\windows\windowsupdate\scheduled start" /disable
psexec -i -d -s schtasks /change /tn "microsoft\windows\WaaSMedic\PerformRemediation" /disable
Explanation: The first two commands disable the Windows Update service, the last three disable scheduled tasks that re-enable Windows Update.
Now, to run Windows Update when you want to, all you need to do is start the Windows Update service, which can either be done through the Services management snap-in or the following (administrator) commands:
sc config wuauserv start= demand
net start wuauserv
You can then use Windows Update normally through the Settings app.
Thanks to muchomurka on tenforums.com for providing the commands to disable the planned tasks.