By default, WordPress automatically updates when minor releases become available, but does not automatically update your site to major releases. We recommend keeping this functionality in place, as minor releases rarely cause issues with existing themes or plugins and often include patches for security holes.
However, if you don't want WordPress to ever automatically update its core for minor releases, you can add the following line in your wp-config.php file:
define( 'wp_auto_update_core', false );
You'll see a section toward the bottom of the file that includes other define() clauses. Just add the code above on a new line, save the file, and upload it via SFTP if that's how you're updating, and you're all set!