I haven't had any problems with forced system updates per se. While devops option to disable automatic updates COUPLED with the moto system update app set to disallow automatic installation, I find when there is an update it tells me so and I can then perform a manual download and installation. So it works.
Yep that's the screen. I should had mentioned it's a menu option within the Android Settings menu screen and not a launchable app.
Keep in mind as is noted as a footnote in the Smart Update screen, security updates will download and install automatically even if the option is turned off. You might end up seeing a notification saying there's an update ready to be installed and suggesting you reboot the device. Outside of disabling the moto software update app altogether I've found no explicit method of blocking these security updates from auto installing.