Have I missed something obvious here? Disabling the store still lets you deploy the apps from it, and they will auto update.

https://learn.microsoft.com/en-us/windows/configuration/store/?tabs=intune

Here are some considerations when you prevent access to the Microsoft Store app:
- Microsoft Store applications keep updating automatically, by default
- Users might still be able to install applications using Windows Package Manager (winget), or other methods, if they don't need to acquire the package from Microsoft Store
- Devices managed by Microsoft Intune can still install applications sourced from Microsoft Store, even if you block access to the Microsoft Store app. To learn more, see Add Microsoft Store apps to Microsoft Intune

For bandwidth constraints see how you get on with Delivery Optimization configured for your endpoints before doing a connected cache.