yes, but you can set other group policies in the same place that'll prevent them from doing it the normal way (it'll be greyed out in the automatic updates config). but no way to trump local admins that i know of.