Disable Windows Update while allowing the Windows Store?

Out of curiosity, why would you want to give the public admin rights on public devices? How can you possibly secure that?

First things first, if you give everyone admin rights, then you can't effectively do anything with policy - the admin can just turn the policy off, since they're the admin. Trying to prevent an admin from doing anything is a losing proposition.

Second, blocking updates seems strange - with the recent WannaCrypt attack, we saw the damage that can be done by not running updates. Is the intent instead to gate updates through something like WSUS so you can stage them, or just not update them at all?

I'm really confused by the scenario. Normally, for public computers folks are looking for ways to restore to a known state and provide as much security as is reasonable (understanding that physical access trumps all, per the 10 immutable laws of security).