Just my opinion, but your first option seems most logical to me. Since you're already going to use the latest 21H2 installation files, I think most updates are included, except maybe some device drivers. That's what I plan to do with my HTPC which is now running a very early version of Win 10 (first disconnecting network and uninstalling Sledgehammer, then using 21H2 setup option to keep files and settings rather than clean install in this case). Before connecting network, I'll reinstall Sledgehammer 2.7.3 rc1a, which has worked very well for me through 21H2. But I'm not sure there's a big difference in the two options, since you're already committing to installing all the updates in the current 21H2 setup download. I think the main thing is to keep your goal by preventing any upgrade to Windows 11. Maybe others will weigh in.