You can install java if you need to run apps, just permanently disable the plugins in Firefox.
I think by default Firefox is going to start doing this in future anyway.
That feature is already in the current version of firefox (there's a dropdown box in each plugin asking if you want to activate the plugin or not).
It doesn't have proper automatic update. Java's answer to auto-update is a silly little notification pop-up. I've only ever seen this pop-up on XP machines running as Administrator. It doesn't seem to play nice with UAC.
It has been working on windows 8, but it always triggers a UAC prompt when there's an update available.