That PC is only for controlling this machine and no need to be on internet, right? If so, just config the windows firewall to disconnect it from the internet?
I do that on my home machines. All updates are disable and I manually enable them every 6-12 months to let win10 to go crazy for a day or so and everything is up to day.
One can also monitor the podcast such as "Security Now" to check if the latest windows update processes have any special BSOD or silently / randomly delete all users files/profiles before turn on the update.
Except you need them on the local LAN to share data, and you need them to have internet access through the local LAN so the vendor can log in remotely for maintenance and troubleshooting.
I do that on my home machines. All updates are disable and I manually enable them every 6-12 months to let win10 to go crazy for a day or so and everything is up to day.
One can also monitor the podcast such as "Security Now" to check if the latest windows update processes have any special BSOD or silently / randomly delete all users files/profiles before turn on the update.