The best thing to do is just make System Updates optional, simply, osupdates = true/false.
No detours, ifs, buts and hassle. I know plenty of people who rent a server with DirectAdmin on it and have it customized. A simple apt-mark hold (Debian) is of little use because that also means that any...