Hello @wannas,
In you favourite search engine enter “firewall rules to block Microsoft updates” (& change Microsoft for each operating/device/service you want to block) and work through the half first dozen answers you will find out it is almost impossible to block most modern updates and it leave your systems open to vulnerabilities, though you can certainly attempt it.
You can have a go at putting these into the Content Filter within the router (best to use firmware 7 and above), if you have a higher end network device, then the there are more categories to help so you may not need to enter all of the domain you find from the above search results.
Have a look through these two previous posts for further information on how to do this once you have worked out your domains to block for your devices.
With such low bandwidth, another options is to only allow access to what they need for the business such as email server, document server, in house servers.
Be aware that if using certain software (such as office 365) they need to frequently verify the licence online or the software becomes either restricted or locked out.
Happy to Help,
Marcus 