Windows 10 1809 - Feature on Demand but prevent users from using WindowsUpdate

We use a SCCM 1810 environment. Beginning with Windows 10 1709, you can’t use WSUS to host Features on Demand and language packs for Windows 10 clients.
Since we use Windows 10 1809 I noticed also RSAT and Language.Handwriting packages are not available anymore in WSUS/SCCM environment.
Instead, you need to download them directly from Windows Update. So just used Get-WindowsCapability commandline and tried to install missing features and ran into 

0x800f0954 error. After changing the GPO “Download repair content and optional…” we now receive a different error: 0x8024002e. Changing  Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DisableWindowsUpdateAccess from “1” to “0” prevents error 0x8024002e and
commandline: ”Get-WindowsCapability -Online | where name -like *.....* | Add-WindowsCapability -Online” works now.

But now, our users are able to use “Windows Update – Check online for updates from Microsoft Windows” directly.

I have something to consider that our users are now able to download and install Windows Feature Updates (f.e. 1809) over here.

Is there any best practice how to prevent users from installing updates from WindowsUpdate directly?