That defer setting should work. Do you have another configuration profile with the same payload somewhere?
Also, if you want your devices to see 16.6.1 (released on September 7), maybe use a 28-day deferral. You can send remote commands to download and/or update to 16.6.1.
Using the Defer Updates is the correct procedure to block any updates being activated on the device itself. I was able to use Jamf School to push an update to a test iPad even though I had the Defer active on it. This was pushing the newest 17.0.x to it, but it worked. I have not attempted to push a 16.x.x while Defer was active.
As a side note, I attempted to test downgrade a device to 16.6.1 using iTunes, but it refused to work due to the IPSW not being a signed installer. The latest signed IPSW that I could find is 17.0.2. Again, I don't know if pushing 16.x.x with Jamf's "Devices > Updates" panel will actually install the older iOS to a device that can take the newer iOS.