Comment 1 for bug 1546649

GNOME Software checks through Polkit whether or not to do this by checking the allowed and can-acquire permissions of org.freedesktop.packagekit.trigger-offline-update. If either is permitted, it'll try running its update manager, so I guess we have to explicitly forbid those permissions somehow.