Unfortunately the majority of our devices are taken home with students or in partner districts whose networks we don't have control over. I just didn't know if there was a way via a profile or something that I was missing.
Supervised devices have "Web content Filter" profile where you can define a blacklist.
I'm not sure if iOS internals are respecting this profile, and if blocking
would then block updates.
I'll ask our Apple contact.