If you have an old WiFi access point, hook it up in the garage with no internet connection and connect your car to it. The car will think it has a connection but it won't access anything, so phone network should be off (no app access, no Tesla engineers hacking your car)
Tesla won't be able to remotely connect to your car in the garage this way, and it's doubtful they will initiate a remote install while you're driving. The most they can do is command your car to download over the phone connection when away from home but that will take forever on 3G cars and they will still need to be able to remotely conenct to start the update.
That is not going to prevent a forced update. My car has been off WiFi for 3 years. In fact my car’s official home is in Maryland, yet while I was in Florida Tesla downloaded the update (without my knowledge) via LTE and then installed it without prior notification. One day I was on version 8 software. The next day, when I got in the car, there was a notification on the screen that the software had been updated.