By default the play store only checks for updates over wifi, but you can check this in play store settings.
If you have ICS installed I would suggest Onavo extend, save up to 80% on your data usage with a compression VPN. Works on GSM Data only and excludes streaming like youtube and shoutcast.
You can use onavo monitor to see whats using data and it also has a very bad wifi restriction function, as its not root it cannot technically restrict the app so what it does is simply kills the task as soon as it tries to access network data, this has the advantage of saving money at the expense of battery especially with persistent apps. It can result is substantial loss of battery life if the app keeps relaunching and needs to be killed.
Best bet if your extremely worried and need absolute control would be rooting and installing droidwall, but to be honest that's only needed if you have an extremely tight budget and are too stupid to setup your apps correctly. With proper in-app and background data config your phone will use almost nothing. I have 102 apps installed, many of which support background functioning but I only use 30-40k in the 30 minutes it takes to get to work. I do not bother with firewall, onavo extend is the only "saving" app I use.