My work computer is managed via JAMF. I don't how they do it but the company dictates which updates are applied and when. The user is given an option to "defer" through a pop up that indicates an update (or MacOS upgrade) is now required. The user can defer for 1 minute, one hour, one day ... but after too many deferrals the update is simply applied (with a restart to get it started) whether the user agrees or not. The employer can also delay or block updates -- which is sometimes needed due to custom software that needs to be compatible.
As an example -- all Macs are now mandated to be on Big Sur. Monterey is recommended but is still optional, e.g. the user can defer this when it is presented, although we expect Monterey to be mandatory within a few months of now. These items are presented monthly through monthly patching/update cycles. Security Updates are usually mandatory within one week of them appearing. MS-Office updates are applied in the background whether the user likes it or not. Other tools (such as Webex, Jabber ... etc.) are quietly pushed out in the background invisibly.
Other mandatory updates that the user has to make: password changes on a periodic basis (applies to both the full disk encryption as well as user login password and network passwords).
It is definitely possible to remove or eliminate the ability of the user to defer updates. You might allow them one or five minutes to permit saving of open files and orderly close down of open programs, however.
