We had a batch after this where before I "Check for Updates" I went to the "Advanced Options" in Windows Update
-Choose When Updates are Installed
>Choose "Semi Annual Channell (Targeted)"
A feature update includes new capabilites and improvements. It can be deferred for this many days:
>Set to "365" days
A quality update includes security improvements. It can be deferred for this many days:
>Set to "30"
After that I was able to install Endpoint protection DESPITE of the updates.