back in the days I used this to make sure the tiWorker wouldn't perform any tasks anymore (run as part of the seal script AFTER the machine was fully up-to-date and rebooted a few times to see if it's really in a steady state):
TiWorker
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance]
"MaintenanceDisabled"=dword:00000001
Windows Update
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"NoAutoUpdate"=dword:00000001