So your ISP has the capability to automatically provide you with updates to fix security issues on your router (thus helping keep out the 'countries in the East') and you want them to turn this off? Smart. If you're really that paranoid, I suggest you open your wallet and buy a firewall to put between the LAN port on your router and the rest of your internal devices.
I could buy a Firewall, but why should I have to?
To keep control of your bastion host.
That's what I did, I even disconnected the antennas from the ISP-supplied router.