You can also edit GoogleUpdate.exe's NTFS permissions by, first, removing the inheritance:
icacls %localappdata%\Google\Update\GoogleUpdate.exe /inheritance:r
Then, remove the user's permissions to which the scheduled tasks "GoogleUpdateTaskMachineCore" and "GoogleUpdateTaskMachineUA" are ran with:
icacls %localappdata%\Google\Update\GoogleUpdate.exe /remove:g %userdomain%\%username%
Depending on your Google Chrome Installation, the path may be different. I suggest taking a look in the "Action" tab of both scheduled tasks to extract the exact path.
EDIT: Actually, this feels like it's not enough. The GoogleUpdate.exe might not be there when you install Chrome and could be added later. You might want to create an empty file Chrome won't be able to overwrite:
mkdir %localappdata%\Google\Update\
copy NUL %localappdata%\Google\Update\GoogleUpdate.exe