Hi MikeMurphy-5799,
Thanks for your posting on Q&A.
In my opinion, there is no need to hide/deny the updates if the default update source is WSUS. Just approving the needed updates and installing on the clients is OK.
Starting with Windows 10, it's hard to install updates manually in Control Panel. This feature which hide/deny the undesired updates no longer applies in Windows 10. But the Show or hide updates tool may help. Here is a link to download this tool for your reference:
https://support.microsoft.com/en-us/help/4026726/windows-10-hide-updates-or-driver-updates
Please don't forget to MARK the answer if the above solutions are helpful.
Regards,
Rita