You might try to do manually what the since-disabled private command `7777 did on the K1 (ie. mangle the OTA version number in order to disable OTA updates). Check igorsk's blog for details.
But I have no idea if:
* That will work on modern devices.
* What averse side-effects it could have.