Using Windows Firewall To Block Updates

I have a few PC's and they have multiple connections to the internet. These connections appear on each PC as a different network. One of the connections is very expensive and metered, so I don't want Windows updating when the primary connection is down and the secondary only is available. For most applications, what I have done is created rules in the firewall to block/allow them on specific networks, but the most dangerous application of all is Windows Update. In ten minutes that can use my entire monthly allowance and then run me in to a huge bill! It's essential that I stop Windows Update using the fail-over network. Does anyone know what application should be blocked in the firewall to stop Windows Update?

I don't know how 'do-able' this is in Windows (bearing in mind I have a Linux background !!) but.....

Windows update depends on the BITS (Background Intelligent Transfer Service) running. If it's not, then it can't check or download updates.

So, I'd be looking to write a script (triggered from task scheduler) that checks if the primary connection is up and if not, turns off BITS. If it is up, it'd just restart the service.

Doing it this way would ensure no updates can occur if the primary connection is unavailable. This is pretty simple to write under a Linux shell but I have no idea (yet !!) if it can be done with a simple batch or powershell script. I would imagine however that it can be.