Microsoft states in the "System Center Configuration Manager 2007 Software Update Management Guidance"-white paper that it's possible to 'install all applicable updates with only a balloon pop-up from the notification tray' and thats how I want to distribute the updates. Users should be able to start the update process till the deadline by themselfs but not to disable single updates in the update package.
But I didn't find a way to configure that in the Deployment Management to disabl;e the 'Custom (Advanced)'-option in the client.