When I install on-prem always-on graphics and interaction servers as part of permanent architectural installations, I use Win 10 IoT Enterprise LTSC for this reason - it allows me to only apply critical security (no features) updates, and to schedule them at a time when downtime due to issues with the update are not likely to be disruptive.

Edit to mention I always make sure these machines are on a VLAN alone and properly firewalled, as we are deferring patches for sometimes weeks after they come out.