Yes. The typical practice is to separate servers/business critical computers from client computers. E.g. keep them in separate OUs and apply separate policies. I always set servers to download updates but not install and client computers to automatically download and install.
One of the strangest things I've seen is that SBS Essentials is configured to automatically download an install updates (potentially restart) out of the box. I recommend changing it to download but don't install.
.png "ACUF Donor I")
