By default, Windows 7 automatically downloads and installs the latest updates on your computer - not just essential security and critical updates, but also improvements and stability updates. The most secure configuration is to install all updates as they are released, to keep your PC fully patched. Even with an up-to-date antivirus solution, an unpatched PC you could remain vulnerable.
Open the start menu and type "Windows Update" in the search field. Click on that link once it appears in the results under Control Panel. You'll get to the summary screen, which shows if any updates are currently available. Ignore those for now, and click on the "Change settings" link on the left.
Depending on your UAC settings, you may need to supply the administrator's password before you can change how Windows Update works. Under the Important updates dropdown, select the second value: "Download updates but let me choose whether to install them". That means that they'll be ready to install as soon as you are ready, but it still gives you a chance to hide the updates you don't want, like the Windows 10 upgrade / notification tool.
To keep your PC as safe as possible, ensure that the first checkbox is checked: "Give me recommended updates the same way I receive important updates" centralizes your patches. Example: if you're using Windows Live Mail, a free email program made by Microsoft, you will be notified, and get, the latest patches for all Windows Live Essentials products you've installed!
The second checkbox, "Allow all users to install updates on this computer", is tricky: on one hand, you don't want updates not to be installed because someone doesn't have the administrator's password. On the other, you may not like letting other users decide which patches to install, if any. Remember, you just told Windows 7 not to automatically install them! Click OK to save.