You can run your own internal copy of Apple's Software Update Server using a module in Server.app but this by itself does not force the Mac clients to install those updates. You can run a third-party equivalent on a Mac, PC, or Linux using Reposado, again this does not force the Macs to install those updates.
You can use a tool like Apple Remote Desktop to send a command to the client Macs telling them to check for updates and install them, but this only works if the Macs are turned on and on your local network, also even if the Mac client is turned on and connected it might not be a good time to do the update.
The better solution if not best, is to use a tool like Munki (yes that is how it is spelt). This can not only force the Mac client to check for and to install updates, but it can also avoid the end user having to enter an Admin password, it can work with remote users as well as local users, it can wait until the Mac is shutting down so as not to interfere with work and then do the updates, and it can cover updates both from Apple and also any other software you are using.
It does need a fair amount of setting up. There are also additional tools like MunkiWebAdmin and Simian to help make life easier.
Note: Casper can also do this but not as well as Munki