Probably not exactly what you're after, but a viable option might be;
- turn off that export option you mentioned (options nfs.export.auto-update I believe)
- use a script to provision the volume and export the locked down NFS mount
i.e.
vol create volume1 aggr1 1000g
vol options volume1 no_atime_update on
vol options volume1 convert_ucode on
vol options volume1 create_ucode on
vol options volume1 nosnapdir on
exportfs -io rw="192.168.0.100 255.255.255.0" /vol/volume1
or, if your client uses netgroups to provision NFS access;
exportfs -io ro,root=@trusted,rw@friendly /vol/volume1