Yes i would suggest disabling both Windows Update and Windows Modules Installer in your GI. If you run the OSOT it will also disable both of them.
Microsoft is quite aggressive with it's update process.
Apart from not not having persistent machines these services (mostly the TiWorker process) runs during logon hogging up your CPU and decreasing density on your servers.
Regarding the upgrade. I have created a new appstack with the 2.15 agent without the Windows patches and with the regkey and it worked like a charm. I have not tried to update one although the process is pretty straightforward..