I used SCONFIG to change automatic updates to 'Download Only' but I was told it doesn't prevent reboots outside active hours, is that correct?
If so, Do I have to disable the 'reboot' task in Task Scheduler to avoid reboots?
The default in Windows Server 2016 is 'Download Only', which you note you have also verified using
This setting does not apply updates at all on its own - so no reboots will occur. By default, the server will only reboot if the 'Automatic' setting is selected.The maintenance window only applies to updates applied using the 'Automatic' setting.
Additionally, you can configure more granular Windows Updates settings using Group Policy, under
Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Windows Updates.
If applicable to your environment, I would recommend familiarising yourself with the available policies under that heading - in particular the
Configure Automatic Updates policy, which has granular settings including specifying the automatic maintenance window for automatic updates if selected.