This has come up a lot, and Micha’s answer has always been that there is no way to disable the automatic downloading. I thought for sure there was a ticket to be able to turn that off, but I can’t find one. I guess it’s just been mentioned in passing in other tickets. This causes a lot of issues, especially for clients of mine who have zero internet access on their servers. Heck, I had a govt shop that about flipped their lid when Lucee phoned out to the time server to sync the clock. I’d say let’s put in a ticket for have a flag to disable this.
As far as your second question, I’m not sure if Lucee will use the “next best” bundle it can find or just blow up if the OSGI bundles it has aren’t the latest version. I know the list of bundles is in an XML file that the Lucee build uses, but any time you update Lucee, I think there’s the chance that Lucee will then want a new version that it doesn’t have. I do know that if Lucee is unsuccessful in downloading, the deploy log or console log (I forget) will have a message that tells you what to download and where to put it. I hardly call that a comprehensive solution, but that’s everything I know