Q: "Disable communication to all the systems you do not want to update."
A: The only safe way is to physically isolate such environment. A firewall might be an option. But, it's not feasible if you want to keep ssh or other connections that Ansible might use.
On the configuration level, there are many options.
1) Special user
Create a special user for this purpose on the systems you want to update. For example user ansible_update. Depending on your environment configure the DEFAULT_REMOTE_USER to ansible_update. This way you make sure no other systems can be connected by mistake.
In addition to this, you control who can connect to these systems by putting their public keys into the authorized_keys of the user ansible_update at the remote hosts.
To enforce this you have to:
- monitor users at the remote hosts and their authorized_keys
- scan your project (playbooks, roles, inventory, configuration) for remote users other than ansible_update
2) Bastion host
A better option is creating a bastion host and making it the only source of the configuration for the environment.
The most flexible option is configuring the remote hosts to pull their updates on their own.
Conclusion: Create special users, create a bastion host, and make the remote hosts pull the updates from it.