Managing Windows 10 Upgrades without disabling preboot?

[benjaminmh]

Interested in hearing how other organizations are managing Windows 10 Upgrades (i.e. 1709 to 1803) without compromising the security of their systems.

I've worked with McAfee on this, but their answer is "disable preboot," which is not ideal, given that using WSUS, we cannot precisely control the window of time at which a computer will reboot.

We've tried tooling around with the autoboot utility - Ideally, we would have a way of detecting when the computer is about to start the upgrade, and disable autoboot accordingly. 

Any thoughts would be appreciated!