You need to uncheck VSE 8.8 from the Product update task so that VSE 8.8 patches/hotfixes will not be deployed to the client machine.
Thier are actually several ways this can happen. Please see KB57905. The easiest way to prevent this is to check the patch into the evaluation branch and don't put it in the current branch until you are ready for a broad deployment.
I should mention that KB needs to be updated as thier is another scenario where this can happen. Anytime a client completes a deployment task which actually installs a product it will trigger a on-click update and a one-click update will apply any update it finds in the repository for any product currently installed.