Honest answer, I don't think you would. If you blocked everything and only allowed certain domains then you'd run into problems because it's very likely that the whitelisted sites will reference other sites for images and so on and you'd end up with a site that doesn't load properly.
Pi-hole doesn't work on services, so there's no Windows update object. You'd need to manually whitelist each and every domain that Windows update uses.
What are you trying to achieve? If you're wanting to block internet access to only certain sites then DNS isn't the way to do it.