Just thinking of another way to do this with (hopefully) less human interaction. A local apt repository (Using debmirror with some scripts to generate a list of allowed packages), and set most machines to use that repository. Then set up unattended-upgrades with some extra exclusions (like the kernel upgrades mentioned in the post). A subset of machines with some extra monitoring could be used as canaries, by pointing them at the standard repositories. For monitoring, maybe a dashboard that polls the machines for all installed packages and compares that version to those in the local mirror and the standard mirror?