We can enable "Log all allowed traffic" in firewall options policy and perform the action, then check FirewallEventMonitor.log and create block rules to block
eg: Block windows update
You can enable "Log all allowed traffic" in firewall options policy and perform a windows update. After windows update is successful check the FirewallEventMonitor.log and create block rules to block windows update. You may need to put the rules at top in rule set.