Currently assuming you're doing this from correct account and with correct permissions...
In most of the threads online most people either use BitsAdmin or else there's an option in the WSUS console to require approval once to download things. Since I don't have a Windows 2012 server close by can't confirm this.
https://social.technet.microsoft.com/Forums/windowsserver/en-US/2f596f9e-9c76-4e22-9899-dfc5921b94b9/cancel-updates-download-wsus-3-sp1?forum=winserverwsus
http://forums.whirlpool.net.au/archive/1264493
I'd be looking to see if there's something in between (an intervening program that is stopping process shutdown of BITS and WsusService) that's holding things up. You may need a utility such as EndItAll to speed up the diagnostic process. Else, just go through services.msc, then BITS/WsusService -> Properties -> Dependencies. Note what you see and shut things down in sequence to shut things down (you could also take a look at the SysInternals suite of utilities to do this as well).
https://technet.microsoft.com/en-us/sysinternals/bb795533.aspx
Something thing to think about is whether or not the WSUS has been updated but the program hasn't reset itself. Hence, the network connection is still running. Killing off the network connection in particular should deal with it...
https://stackoverflow.com/questions/8688949/how-to-close-tcp-and-udp-ports-via-windows-command-line
If all else, try this one.
http://www.sbsfaq.com/?p=3181
Basically, setup a dummy server/DNS entry option somewhere whether it's on your server or on a network device somewhere between your server and the Internet. This will effectively stop the download (you may need to clear your DNS cache or else restart your server though) because the traffic will get re-directed to a non-existent location. If the dummy doesn't work it's probably because you figure out where the traffic is going in which case you'll need to use something like netstat or wireshark and then use this to modify your routing table to stop the download.
Another way is to attempt to fool WSUS with dummy files via a dummy server (you'll need to hack some things obviously). That way it will download the dummy files instead of the real files.
Another way around the problem is if you know of a proxy server at your ISP or elsewhere within your organisation where you can get WSUS updates from use that so that it doesn't add to your ISP bill.
Of course, you can also get around this by copying the relevant files and folders from another WSUS server on to your own to fill the requirements of the database and hopefully it will just skip over the desire to download once more.
Another way is to deliberately attempt to corrupt the WSUS executable so that it literally can't run (think of how executable patching works). It could be as simple as opening up the executable in a Hex Editor and then changing a few strings here and there so that it can't run.
Another way around it is flushing or deliberately corrupting the WSUS database to give you a clear run at things (a side effect is that it will also allow you to achieve selectivity as you desire). Ultimately, this makes me wonder or not whether or not someone out there has built a tool to deal with this issue or whether you can build it yourself if WSUS 4 and Windows 2012 is really that weird.
How to completely wipe WSUS and start again
http://www.urtech.ca/2016/10/solved-how-to-clean-up-and-repair-wsus/
https://blogs.msdn.microsoft.com/george_bethanis/2014/09/18/cm12-r2s-wsus-servers-corrupted-wid-windows-internal-database/
Another way to deal with it is to create a rule in your NIDS/HIDS/IPS/IDS or web proxy to filter out attempts to download particular files which (as a side effect) will also cancel the downloads.
Possibly, take the server offline if it's non critical.
Starting from scratch again is another possibility but it's clear you want to avoid this.
Obviously, one thing to think about is whether or not you have tried restarting the server. If all the correct options are checked but they haven't taken hold yet it's a distant possibility.
WSUS downloading updates when "Do not store updates locally" is set.
