Actually nope.
- The "Automatic Updates" toggle only affects game updates, not system updates. Apparently. Or at least thats what I read on the subject matter.
- System Updates could get downloaded as soon as you get online.
- They dont get applied automatically though - they present you with nag messages, which you can deny. Rebooting the system (not standby) also should delete them (downloaded, but not applied updates). If it doesnt, there is a way to delete them by entering and exiting the service menu - if you need to, look it up.
I suspect, that the HBL DNS has the Nintendo update servers on a blacklist - so you should be ok, as soon as you use it. I havent confirmed it though. Both my home router and my smartphone (hotspot) have the Nintendo update servers on a separate blacklist - so I havent "checked it" so to speak.
So if you want to edit in the HBL DNS, it might be a good idea, to go "offline" (unplug the cord) for the time while you are connected to the wlan - but not have the DNS entered in yet. Presuming, that the DNS will block the update servers from then on. (Need confirmation on that.)
Getting the update downloaded isnt so bad, as you can still get rid of it, so you have a safety net, as long as you NEVER hit update on the nag message.
edit: There is conflicting information about the "disabling auto updates" option affecting system update downloads out there. F.e.:
https://reswitched.tech/info/faq
edit: "My version" makes more sense. At least theoretically.
There are no reports out there of the Switch "auto updating the firmware without asking the user". They cant auto update firmware in the background anyhow, they need to make sure, that the user is aware - and doesnt reset the system, while its doing it. The option is called auto-update, not auto-download -- so the options in settings ought to be referring to game updates.
Only question remaining is, if that option also prevents an auto download of the most recent firmware - and the answer there ought to be no - otherwise people wouldnt be setting up custom DNS servers, to prevent that behavior.
Case closed.