Globally disallow NuGet restore as side effect of other dotnet commands in Azure DevOps

TLDR: How do I enforce that no dotnet command in my yml pipeline is allowed to restore NuGet packages unless explicitly told to do so? To ensure only the explicit NuGet restore (and corresponding Cache@2 task) get to do restores?

I'm enabling NuGet package locks and caching in my Azure DevOps build pipelines based on this blogpost by Microsoft. The relevant NuGet steps become this:

- task: NuGetToolInstaller@1
  displayName: 'NuGet Tool Installation'

- task: NuGetAuthenticate@0
  displayName: 'NuGet feed(s) Authentication'

- task: Cache@2
  displayName: 'NuGet Cache'
  inputs:
    key: 'nuget | "$(Agent.OS)" | **/packages.lock.json'
    path: '$(NUGET_PACKAGES)'
    cacheHitVar: 'CACHE_RESTORED'

- task: NuGetCommand@2
  displayName: 'NuGet Restore'
  condition: ne(variables.CACHE_RESTORED, true)
  inputs:
    command: 'restore'
    feedsToUse: 'config'
    nugetConfigPath: 'nuget.config'

This all works well, I've generated package.lock.json by setting RestorePackagesWithLockFile to true in all of my .csproj files, and committed those to version control.

The problem now is that I have dozens of tasks like these:

- task: DotNetCoreCLI@2
  displayName: 'Build API'
  inputs:
    command: 'build'
    projects: 'Northwind.Foo/Northwind.Foo.csproj'
    arguments: '-c Release'

- task: DotNetCoreCLI@2
  displayName: 'Test Foo'
  inputs:
    command: 'test'
    projects: 'Northwind.Foo.Tests/Northwind.Foo.Tests.csproj'
    testRunTitle: 'Foo-Tests'

- task: DotNetCoreCLI@2
  displayName: 'Test Bar dependency'
  inputs:
    command: 'test'
    projects: 'Northwind.Bar.Tests/Northwind.Bar.Tests.csproj'
    testRunTitle: 'Bar-Tests'

# etc. etc.

All those dotnet build and dotnet test commands will restore packages also when needed. Heck, they might even by side effect update the package.lock.json or so I presume because Azure DevOps tells me on some builds:

Resolved to: <redacted>
##[warning]The given cache key has changed in its resolved value between restore and save steps;
original key: <redacted>
modifiedkey: <redacted>

I know from the dotnet build documentation that I can use --no-restore flag, but then (a) I have to repeat that for all 10ish dotnet tasks multiplied against 10 yml files, and (b) have to remember to do so in all future cases too. Similar story for adding --locked-mode to all commands, I suppose?

Is there a more global way, at the least once per yml file, to prevent any dotnet command from restoring by side effect, and instead respect the existing packages from the earlier restore commands?