Someone else my give a better answer, but this forum concentrates on standard Releases not ESR, so you may be more successful asking elsewhere. If you find an answer do post back as the question is bound to crop up again.

 cfg file is recognized. Why is it updating? 

I am guessing someone decided the .cfg should prevent minor upgrades, but not the major 10-17. As this is not intuitive behaviour, it may be worth going straight ahead and filing a bug at https://bugzilla.mozilla.org/

Is there a different way to stop version upgrades? 

Removing the URL string value from the pref app.update.url should prevent Firefox from finding an update. See thread /questions/929483?page=2#answer-345675

Is this done via a mozilla.cfg file?

Which update related pref lines are present in the file?

app.update.enabled
app.update.auto
app.update.url

You can consider to lock the app.update.url to an empty string value if you haven't done this to prevent any update check.