According to the docker run command, you're supposed to be able to do it via specifying a digest for the container instead of a tag. I couldn't however get it to work to reinstall a container via it's digest
But, if you're actually worried about it in the first place, then I'd suggest that you don't use :latest as a tag in the first place and tag everything with a specific version. Alternatively, you can see when the container was created on the docker tab, and then take a fairly good guess as to which tag corresponds to that date and use it if you need to roll back. I've never had an issue with any container ever updating. Mind you, I refuse to use Plex since most of their updates to the program is completely broken in the first place.