I turn off automatic updates, set DNS to my adblocker, and delete app data for the TV system apps. My shield doesn't pull down the BS updates and has been on the old interface for about a year now.
You don't. That's the trade off to make. You gotta pay a premium for the dumb TV's if you can even find them. If you can't find or pay, you either don't connect to the internet, connect but block every update, or you accept that you can never have actual control of the physical device you paid hundreds of dollars for.
I got given a "smart" tv a couple months ago. If blocking samsung's planned obselence, ever slowing, ad parasite updates mean my tv is slowly more out of date on security patches then whatever. All my sensitive traffic is over https anyway these days. All sensitive data is airgapped.