turn off automatic updates (via GPO or however)
Set the SMS server to PUSH updates (rather than client pull) the package will have all the updates, but is smart enough to determine which machine needs what updates. when you have the server set to PUSH, all you will need to do is schedule a reboot. If you have the client set to PULL then you have greater control of when the updates get installed and can then do the reboot straight after.