If the user has permission to update Windows through Windows update, they will likely have permission to update to Windows 11.
You can block either via Group Policy or Registry edit.
Create a .reg file with the following contents and run it on each system.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"TargetReleaseVersion"=dword:00000001
"ProductVersion"="Windows 10"
"TargetReleaseVersionInfo"="21H2"