help disabling SoftwareUpdate for network accounts

We have student lab situation with iMacs running 10.5.2 doing network logins authenticated by Active Directory, home directories hosted on a Windows 2003 server (don't ask),and MCX client management on an Xserve running 10.4.11. We've also set up a software update server on a Leopard Xserve, and pointed client software updates to that server. But what we *really* want to do is turn off automatic checking for software updates for all student accounts WITHOUT having each student go into software update preference pane and do it him/herself. (We'll do that if we have to, but I'm thinking there is a better way.) Students are getting the software update dialog without asking for it when the weekly "check-for-updates timer" goes off. Kinda disruptive for elementary school-aged kids... I was hoping this could be done with client management, but haven't been able to get it to work. I've been told that changing the software update preference pane changes 3 files, all in user/library/preferences, viz.: (1) com.apple.scheduler.plist (2) com.apple.systempreferences.plist 3) ByHost/com.apple.SoftwareUpdate..plist Anyone know how to do what I want? Or have some ideas on what to try? The main objective is that the software update dialog happens only when an administrator asks for it. No spontaneous checking for updates by network accounts. Thanks.