Get something which disable service receivers/listeners (not just service like Disable Service app does). If you disable SystemUpdate service - this will wakelock your phone - thanks to Google wonderful design, which become "better and better".
But instead you disable 3 receivers for that service:
com.google.android.gms.update.SystemUpdateService$ Receiver - this will run on boot completed.
com.google.android.gms.update.SystemUpdateService$ ActiveReceiver - this will check for OTA on connectivity change.
com.google.android.gms.update.SystemUpdateService$ SecretCodeReceiver - this will check for OTA when your phone "handles" the secret code.
So, by doing this, SystemUpdateService will never have a chance to get OTA and you phone will still sleep like a baby.
Now, what apps will allow to disable receivers? Well, I compiled my own Autostarts. It's old but still job can be done.
You can find something in play store or I can upload my autostarts if you want me to.
Anyway, in summary do not disable GooglePlayServices.SystemUpdate service just its 3 receivers.
EDIT: Here, this is autostarts I've compiled long time ago but still can be run on KK and of cause ads free. Well, you have to "hunt down" those 3 receivers. Just open up one by one and read if this is one of those 3 and then disable it.