I had a new CB come in yesterday as a 37 OS out of the box.
I went through the normal procedure to enroll the device and placed it in the 46 OU.
Even though the console told me it was a 37, it eventually went to 47.
Below are the suggestions from Google (they said this MIGHT work) about how to enroll a device without it updating to the most current OS.
1) Get an unenrolled device
2) Select network and language and press continue
3) At the Terms of Service screen, you can try double-tapping Ctrl + Alt + E and the device may skip the Auto-update screen and take you straight to the Enterprise enrollment screen.
4) Enroll the device but do not sign in yet.
5) Place it in the correct OU where you have the update restrictions
6) Wait for few minutes and sign in and check the version