another way is with the IE8 admin toolkit, you can block it at your workstations so even if the wsus server tries to push it, they will not install it. Also good if your not 100% sure all your workstations have the correct wsus settings.