Manual Server Automation Policy

[rsm-mci]

I need to ensure my servers never update and/or reboot without manual intervention. I created and set an automation policy set to Manual for my servers, but unless I am misguided, it isn't stopping updates. Half of my servers rebooted overnight and it appears they all installed an update, though not by Tactical. I looked in the registry, and it seems that all of my servers have different, or missing, AU settings, and not necessarily in line with my policy. There are no group policies for updates either. All of my workstation policies work without issue.

I read somewhere that if no policy is set, MS will install some updates without asking.

My question is, how do I create a policy that actually prevents updates being installed without manual intervention?