I have no problem to update other programs, with outbound connections set to Block in Windows Firewall with Advanced Security, since I have created outbound rules for each program.
No problem to activate Windows either.
And as I wrote, with Creator 9 it worked to update after creating an Outbound rule to allow UpdateService\agent.exe, but I cannot find the equivalent in Creator 2011.