Paranoid users should block all sponsors, and delay Windows Updates. Then updating may be done with unblocked sponsors. The blocked sponsors can interfere with updates very rarely. I installed Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, several times with upgrades and hundreds of updates. Only one update in Windows 10 FCU failed (one month ago). I simply unblocked the sponsors, and the update finished successfully.
But the most effective protection is not using MS Office, not allowing macros, and using the protected PDF viewer.