By default, vCenter Server will automatically check and download the latest ESXi updates that can then be used by either the deprecated vSphere Update Manager (VUM) or its replacement which is vSphere Lifecycle Manager (vLCM), both of which can be managed under the Lifecycle Manager section in the vSphere UI.
Interestingly, I have had a number of inquiries about disabling the automatic download setting using automation, as I assume users have setup Update Manager Depot Service (UMDS) instance for consolidated and/or offline access.
Disabling the automatic download in the vSphere UI is very straight forward by going to Lifecycle Manager->Settings->Administration->Patch Downloads and clicking on the Edit button to enable or disable the setting.
Because the Lifecycle Manager section combines functionality for both VUM and vLCM, it can sometimes be confusing on which vSphere API to use and this is important becauase VUM does not have any public API and only subset of its functionality can be automated using specific VUM PowerCLI cmdlets. This is another benefit to using vLCM, not only is it the replacement for VUM going forward, but all of its functionality is available using both the vSphere UI or vSphere REST API.
With that said, the automatic download setting is actually a VUM-based configuration and as mentioned earlier, there are no public APIs for managing these settings. However, I recently found a clever workaround that would allow users to automate disabling this setting.