Hey Ken,
Yes, the way to prevent wyUpdate from accessing any sites outside those you specify is to host the wyUpdate self-updates on your own servers or on your customer's servers.
See: How to make a custom version of wyUpdate. You don't have to rebuild wyUpdate to host it on your own servers. Just use the binary that comes out when you click "Build wyUpdate" in wyBuild. The rest of the article applies.