Comment 10 for bug 2008465

There is no actionable item here on our part. The only true way to install a system without having -updates enabled is to install from the initial release isos, and not one of the point release isos.

The point releases isos are all built with -updates enabled, so using them will result in a system with packages from -updates, and while you can certainly try and turn off -updates, sooner or later you will hit issues.

The two options suggested in comment #6 are the only options available to you. You either:

1- leave -updates enabled
2- enable -updates temporarily when installing new packages (this option may also prevent some security updates from installing automatically if they require new dependencies)
3- install from the original release iso