The same way C programmers do: Download the source code into a local folder and include it directly from there. Then you only update it when you explicitly want to.
You can also use npm with a package.json which requests a specific version, that way it won't update automatically.
Final option, which doesn't work for all packages, is to install the corresponding node-*
package from apt, because the debian developers do ship a number of frequently used node packages in the repositories. Eg, apt install node-is-wsl