I still can't setup Windows 10 Firewall to block all except MS Store and Windows Updates! Those 2 functions works if: allow all outbound; allow all outbound for svchost.exe; allow svchost.exe all outbound to all WindowsUpdates websites. But it still too much because through svchost.exe too many services can freely access to internet, it's not right. I try to set Firewall to "block all in&out" and use default Win10 firewall allow rules + add individual outbound allow rules for services: DoSvc, BITS, InstallService (for MS Store), Wuauserv, WpnService, LicenseManager, SystemSettingsBroker, SystemSettingsAdminFlows... but app install from MS Store and WinUpdates does not work!

Who know what also services/rules must be added to firewall for Store and Updates???