We have noticed an issue with the new 10.12.4 update and 13" MacBook Pro (w/ touchbar). In order to block this update, without blocking the App Store, we are pushing the following script in a policy:
#!/bin/bash
sudo softwareupdate --ignore "macOS"
sudo softwareupdate --ignore "macOS Sierra"
sudo softwareupdate --ignore "macOS Sierra Update"
sudo softwareupdate --ignore "macOS Sierra Update-10.12.4"
If you need to allow the users to update, after testing, running the following script will reset the software update to allow this:
#!/bin/bash
sudo softwareupdate --reset-ignored