NetBeans CVS Update is run with arguments "-P -d". So it prunes empty folders and updates directories recursively.
That's why directories are fetched from the repository. 

There is a way for executing this action without "-d". If you invoke "CVS | Update" from within "Projects" view on
required package (make sure that "Tools | Options | General | View Java Packages as: List" option is checked). Then only
selected package (it also works for multi-selection) is updated.

I tried updating from Project view and same problem occurred. The following might illustrate situation better.
Say you have a repository with main directory named "code" with the following top level structure:
one/
two/
three/
four/
file1.java
file2.java
with one, two, three, and four defined each as a module
and with a module called lessThanThree defined in CVS modules file as "lessThanThree code file1.java file2.java &one &two"
When we execute a checkout in Netbeans using lessThanThree as module and a branch of say "branch1", an existing branch,
we get only file1.java, file2.java, one/, and two/ as we should.
But when we select project folder in file view or project view (e.g. "code" dir), and execute cvs update, we get three/
and four/ as well as what was already checked out being updated and those two extra directories are actually checked out
from the main trunk not "branch1".
Netbeans CVS should not checkout or update directories not defined for a module. It should use the module definition
only when updating or else provide options to do so.

As I've already written, for running cvs update without "-d" argument, it has to be invoked on selected package from
within "Projects" view. Then it updates only the directory (package) it was invoked for. 

The problem we have is that, as in my example repository, we have files that sit at top level outside of any sub-
package and our source folder itself is one of the top level directories not the project folder (that folder is 
our "default" package in project view), not the project folder itself. These files, then, can only be updated if the 
whole project is selected and updated, not any individual package. BTW, the top level files represent our customized 
build files for most part.
Based on comments so far, it seems we would have to restructure our repository and build configurations and then use 
project view to update our code through CVS in Netbeans by selecting specific packages. We would probably abandon use 
of the problem CVS module definition and revert to having our developers create projects using entire unqualified 
repository checkout before using this suggested workaround.
At very least, however, any new directories that Netbeans does "update" and create new in a project from "-d" option 
should be from the same branch as one which the project was originally checked out from.( I would certainly categorize 
this as a bug) and further still CVS options should not be hard-wired, such that I must checkout the Netbeans CVS 
module and customize it myself in code in order to setup options differently.

We have tested your scenario here too using command line CVS. We have checked out a custom module and then updated it:
1) cvs co -P myAlias
2) cvs up -d -P

In our test, myAlias contained two folders of an existing module (MyModule/dirA, MyModule/dirB). There were also other
folders and files in MyModule. Checkout downloaded only dirA and dirB as expected. However, update DID get all remaining
files and folders under MyModule. So command line CVS behaves exactly the same as IDE ... fetches all missing files and
directories that myAlias did not contain.
In the first post you say that your cvs update does NOT fetch files that were not originally in the alias definition.
Please send us EXACT commands you run from command line so that we know we are on the same page.

In regard to command line I tested, I ran update without any args from within my working directory.
Command was simply "cvs update".

I see, try to run 'cvs update -d -P' becasue 'cvs update' does not create new directories.

This is what I need Netbeans to do, NOT fetch directories that are not part of module definition. I need to be able to 
update my project, not select packages, without "-d" option. I just checked cvs command line again with same scenario 
and "-P -d" options on update and new dirs are fetched and they are NOT from same branch as the one used to check out 
working dir, so in that respect, Netbeans does behave same as command line.
So I guess my fundematal issue here is not that Netbeans is behaving any differently than command line but that 
Netbeans has hard-wired the options it uses to perform certain interactions with CVS. This is also the case with 
merging between branches through Netbeans in that the IDE does not allow you to add the option to ingnore keywords. In 
modules with heavy use of keywords, not ignoring them causes massive trivial conflicts on merges across branches. I 
have already abandoned use of Netbeans CVS merging capabilities in these cases.

Omitting -d is generally dangerous and NOT what you want, this is why it is on by default. CVS will then NOT create ANY
directories, either top-level or deep in your project source tree. If someone adds a new package or folder to the
project you won't get it unless you use -d. I understand that in some rare cases this is desired but in 99% cases users
want to have it on so I consider this an enhancment saying: Let the default options for cvs update (and possibly other
commands) be configurable, which is already filed as Issue #68053.

*** This issue has been marked as a duplicate of 68053 ***