Craft 3 updates & plugins without allow_url_fopen or SSH
Is the only option to avoid CMS access temporarily, copy down the live database, do any updating locally and then upload the file changes &amp; update the live database?


Pretty much.  You'll want to lock the version of PHP in your composer.json file to whatever your production PHP version is so you don't pull in dependencies locally running a higher version of PHP that you deploy live.  You can do that like so:  https://github.com/pixelandtonic/craftnet/blob/develop/composer.json#L46-L50

Note that allow_url_fopen is a Composer requirement... there are several issues in their repo of people running into this: https://github.com/composer/composer/issues?utf8=%E2%9C%93&amp;q=is%3Aissue+allow_url_fopen