First off, If there's no reason not to upgrade other than FUD, then they should update. 7 only has a little more than 4 years left and is already in extended support and windows 8/8.1 interface is crap vs 10. If they're worried about being spied on stay with a Local account and don't setup a Microsoft account. It will only take the same telemetry that they've been doing since the customer experience program in vista, which you can then turn off. That being said MS shouldn't have started downloading the OS on PC's without explicit reservations but even that can be disabled.
Easiest method to disable windows 10 from updating is to use the DisableGWX Policy setting. This site's Method 3 will walk you through setting the registry key. Microsoft Also has some other blocking methods as well.
If you just want security patches from that point forward go to windows update settings and uncheck "give me Recommended updates the same way I receive important updates"