After trying various supposed solutions to this, most involving toggling some arcane Group Policy setting somewhere, all of which I dutifully toggled, only to find many days later that actually it made no difference, eventually I managed to hit on the right combination, and now I now get prompted for each update!

So it is possible, at least with Windows 10 Enterprise... even if I'm not quite sure how. I've ticked so many damn boxes in that stupid policy editor. But, if you ever find yourself losing faith as you click through another advert-infested Windows "help" site, stay strong! A solution is out there!

(It still isn't perfect, though. Sometimes the updates are downloaded before I get prompted; other times, I'm prompted and then they download. More than once, the "download" process has used 100% CPU for an hour, which makes me suspicious that it's doing a bit more than it claims. And a couple of times when I've had the Security & Updates page open in the background, I've seen things just install themselves without asking, suggesting that certain updates are able to bypass this. But: no forced reboots.)