The problem with pinning packages to prevent them from upgrading is that to upgrade them you need to unpin them again.
/var/run/reboot-required.pkgs contains a list of packages that trigger the request for a reboot after unattended-upgrade has run.
Inside the configuration file for unattended-upgrades in
/etc/apt/apt.conf.d/50unattended-upgrades there is a section dedicated to preventing some packages from being upgraded automatically that looks like this
Edit the list to prevent those packages from being upgraded automatically.
I would start by blacklisting the usual suspects: kernel, libc, gcc, etc and every time you see the computer is asking for a reboot check
/var/run/reboot-required.pkgs and add those packages to the unattended upgrades blacklist.