I have been using a Note 3 on AT&T for about four months now and I have so far managed to avoid unwanted firmware updates without rooting. I am still running Android 4.3.
I don't want kitkat. It doesn't remember wifi passwords. I have also heard of issues with bluetooth functionality and sd card access limitations. Also, battery life seems to be negatively impacted by these updates. I have dodged the updates two different ways.
One way is by going into the application manager in your settings when you see that annoying update message come up. Select "running" apps in the app manager and you will find "att software update." You can't delete it but you can turn it off or force it to stop. That is a temporary fix. Eventually that message will come back again if you do this.
If you want to block the update for a long time as in maybe a 90% chance of never dealing with it again, there is an app called Ad Blocker. The developer is Smartdog Studio. It disables wifi from being used by whatever apps you want. It's purpose is to block ads from apps that use wifi even though they don't require it to run. If you apply ad block to an app that beeds wifi to run, the app simply will not run at all. But when you go to other apps that you want to use wifi with, your wifi will work with those. This app effectively blocks the software update.
It can be glitchy though. Can turn wifi on and off when you have multiple apps that are capable of completing the same task. Like web browsers for example. If I click on something that is trying to take me to a website, and I have multiple web browsers on my phone, there is a screen that pops up basically prompting me to pick a browser. With ad block on the Note 3, that screen that comes up often turns wifi off. Set defaults to avoid that. And if you have over 300 apps on your phone, and you try to go into ad blocker, it will most likely time out and crash. So if you want it to work well I wouldn't install anymore than about 275 apps on the phone. Otherwise it should be fine.