How can I stop users from connecting to Windows Update?

Windows Update is great for getting the latest fixes; however, you probably want to control change roll-outs, so it’s a good idea to stop users from connecting directly to Windows Update. You can do so via a Group Policy:

Start the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in (Start, Programs, Administrative Tools, Active Directory Users and Computers).
Right-click the container of the users (a site/domain or organizational unit–OU), and select Properties.
Go to the Group Policy tab.
Select the policy and click Edit.
Expand User Configuration, Administrative Templates, Start Menu & Taskbar.
Double-click “Disable and remove links to Windows Update.”
Set this policy to Enabled and click OK.