If you really want to disable Updates and Installations, you can block users from installing/updating themes and plugins through the dashboard. Add this quick snippet to your wp-config.php file:

define('DISALLOW_FILE_MODS',true);
It will prevent users from installing and updating themes and plugins. It will also automatically disable theme and plugin editing in the dashboard.

Access to plugin and theme code is available in the WordPress dashboard. You can do one thing to protect the site from trifile to disable the both of these editors. Open your wp-config.php file and add the following constant:

define('DISALLOW_FILE_EDIT',true);

Now, when you are in the dashboard it is impossible to access the theme or plugin editor, even if you are admin.