I'm going to tip my cards here even though I don't want to because it may attract the sort of posts advising me on how I should think. But my mind is made up.
I generally really like Windows 10 but the forced update policy that MS has built into the product is unacceptable. If it were just up to me, I would eliminate Windows and install Linux but there are others and they need MS Office, but they don't need Internet access. These are appliance machines that have to be ready to use on demand.
I want to revoke Internet access to those machines but still allow them to authenticate to the SME domain controller, use the network printers, access the file server, etc.
I am running v9.2. My structure is like this: Cable Modem<>SME<>unmanaged switch<>PCs, printers, WiFi APs.
If you have other ideas on how to solve the forced update issue that actually work, I would LOVE to hear them but I am focusing on using SME to form a work-around. I wish there was something in the server manager web UI that could control this.