Do you have any logs showing the blocking taking place? Perhaps we can help you with the correct exclusion. Check out %deflogdir%\AccessProtection_Activity.log.
These standard settings do effect some things out of the box.
* Office 2016 on W7 SP1 (German)
* FLASHUPDATE in deployment (EXE Version)
I did not know to date with Windows Updates.
* Is this WITH the atcual Windows Update Patchday AUGUST 2017 or do you think that did happens before?
* With ENS 10.5.1 HOTFIX 1 or 2?
* You should see the LOGS in EPO can you post the info here?