I had a call with a Jamf engineer about this and like @sdagley said,
Jamf Catalog wants to takeover updates. Even the the recommended
configuration profile has the updates disabled.
New jamf admin here, I've been using jamfHelper for displaying messages
but this looks so much sleeker (hopefully no one from Jamf is looking).
Great script and writeup, thank you for your contribution!