Would this work?
Install Qubes onto USB Drive then boot up setup all vms update everything and power off.
Then plug writeblocker between USB-Drive and USB-Port boot up and once done turn off and no writing changes to the USB-Drive have been done?
Only ever boot without the write-blocker to install updates preferably from a different network only ever used for updates.
Could this be a workaround to the last thing Tails is superior in (amnesia)?