Updates can't really be 100% blocked, but there are a couple things you can do. If you unlink sysNand and emuNand, you can fill sysNand's internet connection settings with junk/dummy connections (or leave them completely empty) so it won't automatically connect to your home network. It can still grab updates from SpotPass nodes like McDonalds and such, I believe, though. The system will only automatically download updates while in sleep mode, so if you never put it to sleep while in sysNand, you should be fine. (I only ever use sysNand to get to emuNand, personally.)
If you do get an update, it will prompt you to update, but you can remove the nag by using Recovery Mode. Power on the system while holding A+L+R+Up (on D-Pad), and it'll boot into a special mode for applying updates. Just cancel out of it and restart normally, and the nag will be gone. (It's meant to clear out a corrupted update, so it deletes the downloaded update, removing the nag as well.) Recovery Mode doesn't work for emuNand, though, but sysNand is the one that's dangerous to update.