ryrona to have updates done over TOR, set up TOR via whatever app you use in the Owner profile. Use the VPN option in the app. Afterwards, by default, the OS will block connections that aren't made through the VPN, so it'll fail to check for or install updates until after you log in to the Owner profile.