It's almost useless blocking outgoing ports as applications need to send an initial response first to check the server's there (of which no reply will be recieved since the incoming port is blocked).
To only allow Windows Update to communicate, you need to block all incoming ports except the following domains and subdomains:
- windowsupdate.microsoft.com
- *.windowsupdate.microsoft.com
- *.windowsupdate.microsoft.com
- *.update.microsoft.com
- *.update.microsoft.com
- *.windowsupdate.com
- download.windowsupdate.com
- download.microsoft.com
- *.download.windowsupdate.com
- wustat.windows.com
- ntservicepack.microsoft.com
You may be able to use the localhost file to block the above domains, by following the instructions here.
The above are not specific to any Windows version (although the TechNet page is for Windows Server 2003 and XP, this solution works with all modern Windows versions too), so it'll work on Windows versions other than Windows 10.