Selective updates with newly-created installation ISO

Question

I purchased retail boxed/full-version licenses of Windows 8.1 Pro for several new PCs that shipped with Windows 8.1 (non-Pro), but the DVDs included are 1.5 years old. I am considering using option 1 in this tutorial to create a new installation DVD

Question 1: Does Microsoft's mediacreationtool.exe always include the latest (security and optional) updates to Windows 8.1?

If not, I will just use the DVD included in my boxed version.

If so, there are certain updates I want to exclude relating to user data collection.

Question 2: If I use the installation media created by mediacreationtool.exe, can I uninstall selective KB updates?

I don't want to connect a new PC to internet until it is fully patched with security updates.

Question 3: Where can I find update rollups to minimize the effort needed to get security up-to-date but optional patches up to the end of 2014, when I understand that Microsoft had not yet started installing the Windows 10 preparation and spyware into Windows 8.1.

Any other advice from users with similar concerns would be appreciated.

Answer 1

Beverage
Good eBook
<Setup>
md c:\win8
md c:\updates
md c:\mountw8

copy <wherever it is>\install.wim c:\win8
<Internet Explorer>
http://catalog.update.microsoft.com
<agree to plug in>
(Make sure you get the one for the correct OS and x86 or x64)
Type in the KB####### one at a time and add them to cart
When prompted for a folder browse to c:\updates
<Start Reading Book>
<Wait for download>
<Keep waiting>

dism /Mount-Wim /WimFile:c:\win8\install.wim /index:1 /MountDir:c:\mountw8
<Resume Reading Book>
for /R "C:\Updates\" %i in (*.msu) do dism /image:c:\mountw8 /Add-Package /PackagePath:"%i"
<Wait>
<Wait some more>
<Keep waiting>

As long as we have the image mount lets inject some drives

(Modify the path to your needs)
(Make sure the drivers are extracted so the *.inf files are visible)
DISM.exe /Image:C:\mountw8 /Add-Driver /Driver:d:\Drivers\ /Recurse

<Resume Reading Book>

(Finalize the image)
dism /Unmount-Wim /MountDir:c:\mountw8 /commit

Make a bootable media disc replacing the old install.wim with this one.