[ssu] Add basic repo isolation for updates