I think it does not matter. Default one is stable channel (even if not specifically set). Other update channels are daily, beta and production. I don’t know the real differences between stable and production (maybe just delayed updates?) but as the updates are done through nethserver and not using the direct update channels, shouldn’t matter.
Not specifically for your problem, but a setting that (in theory) could prevent some sysadmin to inadvertently update from within nextcloud would be to use the config.php upgrade.disable-web setting to Disable the web based updater (as far as I recall the nethserver rpm package does not set it).