I think the key is actually to disable the macOS Services rule group. They seem to exempt apple.com connections by default, probably so that new users aren't ov

I think the key is actually to disable the macOS Services rule group. They seem to exempt apple.com connections by default, probably so that new users aren't overwhelmed with connection dialogs, but in this case you want to stop the Mac from phoning home. The aptly name softwareupdated process performs software updates.