I solved this after reading multiple articles suggesting local group policies need to be turned on, then immediately back off.
In local group policy editor "Configure Automatic Updates" was "Not configured", as expected. I set it to enabled, pressed OK, then, immediately set it back to "Not configured" and pressed OK. This immediately removed the "*Some settings are managed by your organization" notice shown in my original post and everything is as it should be.
Incidentally, the above completely removed the "Windows Update" registry branch, as you might expect.
There is obviously a bug somewhere that should be addressed.