In SBS 2008 WSUS is enabled by default and will start downloading updates once setup is complete. We use a centralised update service which manages updates for all our clients and means we only have to approve updates once and not for each server.
I raised this issue with the guys in microsoft.private.sbsc.windowsserver.sbs and after some internal discussion they came back and said the only way to stop the downloads was to remove WSUS. Unfortunately this has the side effect of stopping SBS reporting on patch level, but our centralised software covers this anyway.
So I’ve followed MS’s advise and so far so good. No unnecessary downloads and the server is ticking along nicely.