How to keep Windows 10 Enterprise from using anything other than the C: system drive for installs?

This is a question about the latest patch level of Windows 10 Enterprise 22H2.

I work in Enterprise IT; I've been doing it for 25+ years. That includes a lot of offline networks disconnected from the Internet. Many of those networks have heavy restrictions on removable media use and I cannot get into details here. Depending on security policy, it can get end users fired because they triggered security events by running exes which are not allowed to be run from removable media. The problem here is this is now being done automatically by Windows installer.

Some time ago, Windows 10 started misbehaving and leveraging removable media as scratch space.
I just took a Microsoft SQL Server patch i.e. SQLServer2019-KB5033688-x64.exe copied into C:\temp and ran it to patch a local SQL Express instance. My C: drive was actually NVRAM and had enough room.
It started writing stuff to my mounted removable drive, a much slowed HD mounted over USB, without asking.

How can we configure a Windows 10 Enterprise system so the Microsoft installers will never do this again?

Please note I am NOT asking about restricting whether USB removable media can be used on a system. I am specifically asking about new installer behaviour which started about a year ago where any Windows 10 system seemed to start using whatever drive it wants as scratch space for installs.