Comment 7 for bug 2008465

Declining this for the Release Team. The documentation that says this configuration is supported is not owned by the Release Team. Reassigning to Security.

Anyway, in practice you will need to have -updates enabled when installing new packages in order for it to be guaranteed to work correctly. You can use apt preferences (pinning) to control whether packages are pulled from there by default.