How do I prevent servers getting/installing updates from the internet but continue to get SCCM 2012 Windows Updates?

Hi,

We are using SCCM 2012 with SP1 to deploy Windows Update.  How do I make sure that my servers won't get automatic updates (the default 3AM rule) without preventing SCCM to deploy updates to them?

I checked my servers and the current status is turn off.  But I want to make sure this never gets enabled by accident.  OTherwise my servers will be downloading and installing updates at 3am.

Thanks!