For a few years now, our Net Admin has blocked WiFi access to Apple servers which provide updates to iOS devices. We do this to minimize traffic to our users' devices when new updates are released, (we prefer they use their own home networks,) and more importantly, to keep our carted iPad fleet from updating until we have tested updates against installed apps, etc.
At one point, our AppleTVs were also blocked from tvOS updates through the same method, but with tvOS 13 and Apple TV4s, it seems as if new servers are in use which are not blocked and the ATV4s are being updated. We use our ATVs for AirPlay Conference Room display mode with PIN only. I realize now that I can turn off automatic updating, but it doesn't help at the moment.
This is a roadblock for us because after the update is done, the ATV requires clicking a Continue button on a What's New screen with a remote. Until this button is pressed, AirPlay Conference Room mode is unavailable: the ATV does not appear in the list of AirPlay devices on a macOS or iOS device. From early experiences with missing (stolen) ATV remotes, we do not provide a remote in any ATV location. This means I must go around to every ATV4 (and we have many of them) just to click a button to make it useful.
Can anybody please either let me know what the new tvOS Update server addresses might be, or point me in the right direction? I've done a fair amount of searching, but have found nothing definitive.
Additional information 12/11/2019:
Even though I manually disabled auto-update on the ATV4s, with the release of 13.3 yesterday, the ATV4 pops up a notice that an update is available, necessitating yet another remote button click to make the device useable.
The need to find the tvOS update server is now even more crucial than ever.
Best Answer
I would recommend three steps.
The caching servers ensure you only download one copy of each app, each update and no longer can have any sort of overload or denial of service when many devices all arrive and check for App Store or other downloads.
With the latest OS you will literally be breaking how the security works if you can't check for notarized apps and revoked certificates that have malicious software. Also, just not patching your devices is a risk. I would reach out to Apple for help, any workplace with a few devices qualifies for assistance from a local Apple store or direct from a corporate team to help with this.
Content caching needs to reach out to lcdn-registration.apple.com
Today that points at st11p01su-lcdnreg.isu.apple.com.akadns.net which has address 17.164.1.29
There are about 19 other names in the KB above for all updates to run.