I will try to disable Windows Updates in the image if my test fails, also I will check the windowsupdatelog to see if the system tries to download patches.
Patching will be done with SCCM. As far as I know SCCM latest version supports writefilters when deploying patches and apllications. Is that what you mean?