This is a feature when using Debian's 'unstable'. It will want to upgrade all the time.
Another way is to subscribe to the security-announce mailing list, and manually install the packages that are security updates.