Set "Automatically check for updates" to "Never", & then manually update.
The standard Software & Updates GUI is based off of the unattended-upgrades package, which auto-downloads security updates when it checks for all upgrades.
From the Ubuntu Automatic Updates page:
The unattended-upgrades package can be used to automatically install
updated packages, and can be configured to update all packages or just
install security updates.
As XModulo explains:
On Ubuntu, automatic updates are managed by a package called
unattended-upgrades which is installed by default. This package
downloads and installs security updates automatically. Optionally, it
can also auto-upgrade packages available from other configured APT
sources (such as "updates", "proposed" "backports").
Xmodulo goes on to explain that the only way to turn off the automatic security update downloads is to change the "Automatically check for updates" setting to "Never". Somewhat counterintuitive, and not a great solution, but necessary if you need to preserve bandwidth, etc.
Manually updating is fairly straightforward from Synaptic (which may need to be installed), or from a command line:
sudo apt-get update
sudo apt-get upgrade
Of course, you could setup a reminder to manually update, or other creative bash, etc workarounds if you want some vestige of 'automatic' update.