$ cat /etc/apt/preferences.d/systemd.pref 
# not anymore #  Package: systemd 
Package: *systemd*:*
Pin: release *
Pin-Priority: -1

Not sure about the exact syntax, lets say it works so far.
Cases: On debian 12/13 to prevent re-installation of some systemd-stuff. On excalibur, just to be sure. And some "purge systemd in debian"-experiments as a preparation for a controlled devuan-migration.

Variants: On machines with multiarch, it's sometimes "Package: systemd:*"
Compared to @nixer's post: No wild card in the package name. Just mentioning, no clue about the consequences.
Edit: Not good enough anymore without wild cards
Edit2: Never realized the possibility to have multiple package names in one line, which will simplify some .*pref  files
Edit2: Stumbled upon the package "systemd-dev"

I don't know how or what package initially pulled it in, but some time ago "systemd-standalone-sysusers" got pulled in by some update.  I am running ceres, so I see quite a bit more updates than stable, or even testing (excalibur).  I have been trusting my apt pinning to keep out all *systemd* packages for years, but my apt pinning failed me.  For the past 10 days or so, when trying to do an "apt upgrade" command, I kept getting a broken package error regarding "libelogind-compat".  So, I let the ceres install sit not updated.  Finally, I started digging deeper and read a few messages on the dng mailing list, and one caught my eye concerning purging the "systemd-standalone-sysusers" package. 

To make this long story shorter, purging this systemd mess from my ceres install immediately made a positive difference. 

Running the command "apt remove systemd-standalone-sysusers --purge" actually removed cron and timeshift, and a couple other dependencies, but it was only 4 packages in total that were removed.

I then invoked a working pin in apt preferences - etc/apt/preferences.d/00nosystemd :

Then I reinstalled cron and timeshift "apt install cron timeshift" and instead of wanting the systemd-standalone-sysusers package, it installed "opensysusers" package instead.  Then all error messages went away and the system updated as normal.  There are a few (at this moment) packages that will not update, which is not unusual at all, I think it mainly concerns the "libpam-modules-bin" package.  But after purging that package related to systemd, over 600 packages did update successfully.

Beware of systemd encroachment, especially in the unstable branch (ceres).