Excluding apps from Office 365 Click-To-Run deployment?

I'm attempting to install Office 365 2016 through the click-to-run customization and exclude a set of applications. Office installs perfectly fine and the excluded apps are not on the system after the initial install. After I log into my Office 365 account, it starts an office update and the update installs some of the excluded items on the system.

The update installs Publisher and Outlook even though they were excluded in the config and not installed initially. Why is this and how can I prevent it?

installation xml

<Configuration>

  <Add SourcePath="\\domain.com\Software\Office2016\x64\" OfficeClientEdition="64" Branch="Current">
    <Product ID="O365ProPlusRetail">
      <Language ID="en-us" />
      <ExcludeApp ID="Access" />
      <ExcludeApp ID="Groove" />
      <ExcludeApp ID="InfoPath" />
      <ExcludeApp ID="Lync" />
      <ExcludeApp ID="Outlook" />
      <ExcludeApp ID="Project" />
      <ExcludeApp ID="Publisher" />
      <ExcludeApp ID="SharePointDesigner" />
      <ExcludeApp ID="Visio" />
    </Product>
  </Add>

  <Updates Enabled="TRUE" UpdatePath="\\domain.com\Software\Office2016\x64\" Branch="Current" />
  <Display Level="None" AcceptEULA="TRUE" />
  <Logging Level="Standard" Path="\\domain.com\Software\Logs\Office2016\x64" /> 

</Configuration>

This is the official reference on how to exclude specific applications from Office 365 deployments: https://technet.microsoft.com/library/dn745895.aspx.

It looks like your syntax is incorrect; it should look like this (please note the spaces, or lack thereof):

<Add SourcePath="\\Server\share" OfficeClientEdition="64" Branch="Current">
    <Product ID="O365ProPlusRetail" >
        <Language ID="en-us" />
        <ExcludeApp ID="Access" />
        <ExcludeApp ID="InfoPath" />
    </Product>
</Add>

Also, be careful about licensing: if the user doesn't actually have a Professional Plus license but instead has a different one, as soon as he/she logs in to any Office 365 application the setup will automatically start and make sure the installed applications match the actual license assigned to the user; I witnessed this myself when I erroneously deployed a Professional Plus edition to several computers, only to have the Office 365 setup remove Access and Skype For Business after the first log in of users which actually only had Business Premium licenses (SfB was not physically removed but it was made unusable due to a licensing mismatch: it was installed but it refused to activate, because the Business Premium edition only includes SfB Basic, while the Professional Plus edition includes the full version, and thus now the installed application refused to work).