SCCM applies DoNotConnectToWindowsUpdateInternetLocations registry during OS install task sequence

TiborM 

My guess is SCCM/MECM sets this preemptively due to the way the Software Update Point operates, because it assumes you'll be using that.

To workaround, you could explicitly set the GPO to set the key to 0 (or a PowerShell script for Workgroup machines):

Prevent Windows 10 from connecting to any Windows Update Internet locations 

Details:

You mentioned you're trying to use standalone WSUS instead, which operates outside of SCCM if you do it that way.

When you use the Software Update Point role, the mechanism is handled differently under-the-hood. SCCM uses a local WSUS to query the MSFT update catalog, but that's just so the server can grab package content and stage it. The updates themselves are actually delivered to clients via the Software Center, similar to any other app package. Hence, it doesn't need to use intranet locations for updates because CcmExec will query the Disto Point for the package content.

This is likely why the SCCM Client Agent shuts it off by default. In past versions of SCCM 2012, the client agent would throw errors if WSUS settings were already defined, and you'd need to manually remove them before it'd properly start reporting to the SUP.