That PC is only for controlling this machine and no need to be on internet, right? If so, just config the windows firewall to disconnect it from the internet?

I do that on my home machines. All updates are disable and I manually enable them every 6-12 months to let win10 to go crazy for a day or so and everything is up to day.

One can also monitor the podcast such as "Security Now" to check if the latest windows update processes have any special BSOD or silently / randomly delete all users files/profiles before turn on the update.