Why do machines keep auto-updating to the newest version of O365 when policy has it disabled?

Hello EE,

As a forewarning, this might sound a bit convoluted initially.

We recently upgraded our Office version from O365 C2R (build 1701 version .2096) to O365 C2R (build 1708, version .2215).

We've started deploying .2215 to a few dozen users through SCCM and have noticed that most of the machines have upgraded from that to the newest updated version (build 1803, version .2295).

We're using the same ODT install xml file on .2215 as we originally used for .2096 (just changed out the version), yet none of the .2096 machines have upgraded to .2295
I have .2215 on my machine, and it has not upgraded.

For both, Updates Enabled is set to TRUE, and Channel is set to Broad.

My question is, why would these machines be automatically updating to the newest version?  I believe our Security dept has a GPO in place to ban these auto updates.  I've looked through the ADMX and regedit and noticed the 'Enable Automatic Update' value is not listed, so assume that is correct.

Is there something else I should be aware of or look at?

Thanks,