GPO is fine. You could also use the AClient, if you have it, then turn off the DS or remove access to it. The AClient isn't going to run any sort of recurring process like an NS Agent might, so this is a pretty safe method and allows you to maintain control during the in between phase, where the NS Agent is off but SCCM is not there yet.
Alternatively, my favorite method is to use SCCM to disable it, since that confirms SCCM is on the client and functional. If you need to re-enable later, you can use GPO Logonscripts, psexec, or RAAD.