Can you disable drush pm-update for a site?
You can disable the core Update module on the live site,  and then should prevent being able run pm-update on live:


  $ drush pm-disable update The following extensions will be
  disabled: update Do you really want to continue? (y/n): y
  update was disabled successfully. [ok] $ drush pm-update
  Command pm-update needs the following modules installed/enabled to
  run: update. [error] The drush command 'pm-update' could not be
  executed. [error]