My suggestion would be:
1. attempt the Windows update again
2. download the netkope client logs (right click -> save logs) and unzip.
3. look inside nsdebuglog.log
4. filter the nsdebuglog.log file for the word "Tunneling"
5. You should see a number of lines like:
Tunneling flow from addr: 192.168.1.51:56147, process: firefox to host: c1h-word-view-15.cdn.office.net, addr: 18.104.22.168:443 to nsProxy
Look for anything in there where the process is related to Microsoft Update, or where the host is a Microsoft related domain.
6. Add that process/host into the steering exceptions