This is my favorite PiHole rule (DNS blacklist):

    (\.|^)apple\.com$

One can then manually install OS updates, directly from Apple, via <https://mrmacintosh.com/how-to-download-macos-catalina-mojav...> directlinks (should one choose to).