We have a WSUS server that provides a validated list of Windows Updates. The product PCs Windows 8.1 and Windows 10 will use this list to determine which updates to download from Microsoft Windows Update Server/store automatically. Once the validated patches are download automatically, the user will decide when to install the updates manully. This works currently. However, I am able to select "Check online for updates from Microsoft Update" to download and install the unqualified updates manually. Is there a way to prevent the user from selecting "Check online for updates from Microsoft Update" to download the unqualified Windows updates and not breaking what have been working?