Forced Upgrades on domain joined machines

It says it right here in the Servicing Tools section of this article.

https://docs.microsoft.com/en-us/windows/deployment/update/waas-overview

• Windows Server Update Services (WSUS) provides extensive control over Windows 10 updates and is natively available in the Windows Server operating system. In addition to the ability to defer updates, organizations can add an approval layer for updates and choose to deploy them to specific computers or groups of computers whenever ready.

All I want to do is control this through WSUS, I need an explanation to why this Update Assistant is appearing so randomly around my network and not everywhere. Why is it not recognizing my "approval layer" from WSUS? This is all I am trying to achieve here and this has seemingly worked fine up until a week ago when this Update Assistant virus started raising its head.

Its crippling our Business and not even MS support can help, they told me that these upgrades will be forced and there is basically nothing I can do about it due to it being my fault for not planning for this better. They said this update assistant is eventually going to hit every machine in the environment and will ramp up once support for 1607 ends in 2 weeks.

Can someone from the Servicing Team please confirm this for me?

I need to stop this Update Assistant and I shouldn't need to do so through horrible workarounds.