How can I disable automatic OTA updates on a Nexus device on Marshmallow? With Google's new policy of issuing monthly security updates to Nexus devices going on from Marshmallow, me, the proud owner of a Nexus 9 (16GB,WiFi, Build version: MRA58K), has to dirty flash all the factory images every month just because Google issued a 4.0MB update, and I had to connect my tablet to WiFi just because I needed it.

Rather, I prefer to go manual and flash factory images to upgrade between major releases, and ignore those which come in between. So, these monthly OTA updates are a nuisance, even if all I have to do to not install it is ignore the notification it poses. The nuisance being that I have TWRP, root and ElementalX, and prefer to use OfficeSuite over Docs and have no use for Fit - hence I've uninstalled (removed) those system apps, which makes the updates unable to install anyway.

So, the question:

What service(s) or process(es) is/are responsible for downloading this update? Which app are they a part of? And, most importantly, Can I Disable the offending app/process/service without otherwise affecting my system? (That includes interfering with GAPPs in any way)

NOTE: I know the notification is presented by Google Play Services, I checked that. I want to know what processes/services are responsible for downloading the update, not showing the notification.

Edit:

For all those voting to close the question as a duplicate, I have not encountered an answer which satisfies my requirements in the referenced question which this has been thought to be a duplicate of. For future notice, I not only wish to disable the notification, but the updater service as well. Also, the answer provided in the linked question will potentially affect other components of my system, not just the OTA Updater, as it involves disabling all or just notifications from "Google Play Services", which is not at all what I want (I understand what that app is, and disabling any part of it is not in my best interests. So, anything not involving GAPPs is a better solution (since I am heavily dependent on them, excepting the Docs suite).

Edit:

I had since moved on to the PureNexus ROM and rid myself of these issues. Now I have manually upgraded to Android 7.0, and I don't use the device as much anymore. So these answers are not applicable to me any longer, but this question is a good reference point for others with a similar concern.
Rename /system/etc/security/otacerts.zip to otacerts_bak.zip.

This will prevent it from communicating with the OTA update server.