blocking should do it.
but just a thought: what if you run by a free wifi on the go? then you are screwed...
so keep wifi OFF on the go, block updates on your known 3 wifis and always keep a complete NAND + SD card backup (I clone my card every few months) somewhere. so in case of an unwanted update you could restore using a hardmod.