Plugin auto-updates are per plugin, and per site policy

5.5 added a per-plugin auto-update toggle, which is right for a site nobody maintains and is a plugin updating at 03:00 on one that somebody does.

// off entirely, for a site deployed from a repository
add_filter( 'auto_update_plugin', '__return_false' );
add_filter( 'auto_update_theme',  '__return_false' );

// or per plugin, which is the deliberate version
add_filter( 'auto_update_plugin', function ( $update, $item ) {
    return in_array( $item->slug, array( 'akismet', 'classic-editor' ), true );
}, 10, 2 );

On a site deployed from a repository this is actively wrong: the update writes files the deployment will overwrite on the next release, so the site oscillates between two versions with no record of either. Turning it off and keeping the notification is what a managed site wants — auto_plugin_update_send_email controls the mail separately. The decision belongs per site and per plugin rather than as a default anybody accepts.