I operate a lab that offers a multitude of iOS and Android devices running different OS versions for usage with application testing and debugging. We use 10 Aruba Instant IAP-225 WAPs to provide wifi access to all of the devices in the lab. Using the built in security roles "ios-ota-update" and "apple-update" we block access to Apple's update servers to prevent users from updating devices on old iOS versions, stop devices from downloading OTAs automatically, and prevent annoying 'update available' popups. The devices are not connected to any other networks, wifi, cellular, or otherwise.
Since Apple released iOS 12.1.4 however, the blocks in place do not seem to be working entirely. After the update was released a bunch of my devices automatically downloaded the update and had update popups, so I updated my WAPs to the latest available firmware (8.4.0.0) to see if perhaps Apple had switched to a different update server and the newest update would have added it to the block list. This seems to have worked for the most part, now when I manually check for updates on the devices it will say it has an update and when I attempt to download and install it the device tries for a moment and then gives a 'failed to download update' error.
However a few days later several of my devices have somehow downloaded the OTA by themselves and are showing the update popup. When I remove the cached update and attempt to manually install it, I receive the desired failure to download update. Has anyone else seen this issue? I thought I would ask around before I start monitoring all network traffic from the devices for new Apple domains to manually block.