+4
A new installation has clear opt-out possibility.
But, as Paul_D observed, when updating from GUI and it occurs after reboot, it's hard or impossible to catch. Unless you have another way, a firewall or HIPS, to alert that the offer wants to install.