The settings will differ by model and OS version, but here are the steps at least for the Samsung Galaxy S6, running on Android Lollipop 5.0.2 :
1. Open the Messages app and click on Settings :
2. Go to More Settings :
3. Select Multimedia Messages :
4. Disable Auto retrieve :
That's it. Oh, and if your Google Hangouts app is set to process SMS, that is another attack vector. Disable SMS processing in Hangouts as well.
Though MMS and SMS are baked into every phone's firmware, and even supported by newer apps like Hangouts, these old standards are getting more obsolete by the day. It's time to move to the 21st century and use messaging apps instead.