Disable "Configure Automatic Updates" when enabling software updates on clients
When enabling software updates for clients in client settings, a local policy configures the “intranet service update location”. It would make sense to also disable the “Configure automatic updates policy” under Computer Configuration -> policies-> Administrative Templates -> Windows Components-> Windows Update in the same local policy. This would prevent duplicate notifications from the Windows update service and prevent admins installing updates from Windows Update when a SUP is configured
I think this would need to be a client settings. I know that more than a few organizations intentionally leave this enabled so that users can directly scan and updated against Windows Updates. One of the more rational reasons is to allow security to be at the bleeding edge and to manage themselves that way yet still managing to make sure updates are applied and reported.