Stopping Sporatic OS Updates

This is a loaded question. Actually three questions tied to one general
inquiry.
We have various applications and presentation files that are slowed and/or
corrupted when Service Pack 2 and all Windows Updates are applied to our
laptops.

1. We're a 500 plus company. We run Windows XP, Office2K3, SAVv10, and
MSAntiSpyware in a Windows2K3 environment. I use RIS and create four (4)
seperate images for our Dell C640, D600, D610, and M70 company laptops. 70%
of the laptops are deployed to mobile users. Whenever I configure any laptop
master RIS image with WinXP SP2, the image comes out 'hosed' during the image
deployment. I've found that I have to upload WinXP SP1, then add SP2 after
final imaging. We administer over 150 laptops! We've decided to temporarily
deploy with SP1 only. Is there a RIS imaging fix for this so that I can
preload SP2?

2. Before uploading the master laptop image (SP1 only), I 'turn off' Windows
Updates and upload the master image to RIS. We'd prefer our Network Admins
scrutinize all Windows Updates and 'push' the prefered updates via Group
Policy whenever the computer docks to our network. Well, after I download the
RIS image to each model laptop, the Windows Update options when selected from
Control Panels is grayed out. I found a fix in the registry but have to
manually apply this fix to every laptop. This is also the case after loading
SP2. Also, after two or three restarts, Windows Update re-enables itself.
Until we've fully tested SP2, is there a way to permanently disable Windows
Updates?

3. Windows Updates: The laptops are running SP1 but we're testing SP2. I
know that if a user docks their laptop on our network, their gonna get
various OS patches based upon ComputerName/ & GPO. But we're trying to deny
our mobile user laptops from pulling Windows Updates while on the road. They
lodge on various hotel networks with CAT5e and have the failsafe option to
connect to EarthLink accounts I've installed for dialup access. We've
explicitly said that the mobile users are not to download updates. But when
they call for help, they've unknowingly and inadvertantly downloaded SP2 from
Windows Updates. Their computers become very slow. The mobile users are
logging in as local admin while on the road, even though we've created cached
network accounts on each laptop for them. Is there a way, for instance in the
registry, to deny the OS from calling up Windows Updates from Microsofts
website?

Thanks in advance for your responses.