Enterprise deployment of Meta Horizon Link: How to disable auto-updates for 150 Lab PCs?

We admin VR/Immersive software at a University. We currently deploy Meta Horizon Link to ~150 PCs and its used for Unity VR development with Meta Quest headsets. Students do not have admin rights.

When the app auto-updates, the main software installs fine, but the driver updates fail because they trigger a UAC (Admin) prompt that students cannot accept. This leaves the software in a broken state until IT manually intervenes. The rolling/unpredictable release schedule makes this hard to plan for during a teaching term/semester.

What we found so far

Config: We found the new "Disable Auto-Updates" toggle in the UI, but it appears to be user-specific and stored as a binary BLOB in a local SQLite DB (data.sqlite). We are hesitant to script edits to this file on login as it seems brittle compared to a standard Registry key (?).

Network: We are thinking of using a Windows Firewall rule to block the updater exe (OVRServiceLauncher.exe) to "freeze" the version for the term/semester. The trade-off is this would likely block the ability to download new store apps/experiences (though our primary use case is Unity dev, so this might be acceptable).

Questions

Has anyone successfully managed this in an enterprise/education environment? Or have any good hacks :)

Is there a more robust way to disable updates than the firewall block?

If you use the firewall method, have you run into any major side effects?

Thanks!