A domain or policy administrator can force group policy updates from a domain controller to all machines in a given Organizational Unit, within a few minutes machines that successfully receive the remote force will (from the user perspective) have a spontaneous cmd prompt appearance followed by the update results. I have been testing with the updater for my own projects, and even if the updater caused a user policy change it seems very unlikely any number of machines would execute the update all at the same time and affect all users as you described.
Now, to disable updates: did you use the DC Customization Wizard's GUI, or did you set bUpdater, and Mode values in the registry using the mst or in the registry using group policy? If you used bUpdater, which bUpdater did you set? (there are two different bUpdater prefs with the same name).
I do not know if disabling updates prevents the updater service from starting, even though disabling updates does remove the GUI check for updates option, the service might still have been started even if it is unable to apply updates.