If you have endpoints running an OS other than Win10 and you want to prevent Win10 from upgrading the system, you will need to block (deny) the patches associated with Windows10 upgrade. Microsoft has released several versions of patches to push Win10 upgrade, so I recommend you consult with Microsoft to ensure you deny all current KBs related to the Win10 upgrade and/or the Win10 GWX notification.
I do recommend using the KB Override function to block the KBs related to the upgrade/notification to ensure that any future variations of the patches with the same KB number are denied upon discovery. However, as MS has released several KBs over the past ~year, it is important to remain diligent with regard to these MS patches. You might consider subscribing to an RSS/listserv focused on patch management and/or MS patching. Patchmanagement.org is one I use regularly, but there are others out there. These lists may help inform you in the event MS releases or is preparing to release a new KB related to the Win10 upgrade - with a heads-up, you can add an upcoming patch to KB Override, even if there are no machines in your environment reporting that specific patch. It may allow you to stay a step ahead.