The “plexpass” tag always pulls the latest beta. What you want is the “public” tag which behaves similarly (pulling the latest version on restart) but pulls from the stable branch.
See “Tags” in this document:
https://hub.docker.com/r/plexinc/pms-docker/
Short version: When using Docker, the update channel you choose in settings has no impact (other than alerting you when a new version is available, for that channel).