Before allowing the phones to connect to the upgraded call manager, install the old firmware version (meaning the current version your phones are on). The installation will change the device default setting for each model phone that you install the firmware for so the default firmware version on the server matches that of the phone. When the phones do connect to the new call manager they won't upgrade if their current firmware matches the device default. Remember to restart the TFTP service after installing the firmware and remember to install the firmware on all servers in case you use more than one server for TFTP.