i've just fixed this by following this info: https://blogs.technet.microsoft.com/windowsserver/2017/01/09/why-wsus-and-sccm-managed-clients-are-reaching-out-to-microsoft-online/
for us, we were setting 'deferupgrade' regkey via GP, which was the problem. 1607 doesnt like this, and these regkeys are for WUfB usage.
also, you may wish to look at 'Do not connect to any Windows Update Internet locations'
also, ensure you have the 1607 ADMX files installed on your AD - theres a number of new settings for windows update in there..