For Linux devices, you'd tell employees to only install software through their package manager, then have something like unattended-upgrades (installed by default on Debian-based systems) handle automatic security updates.

https://wiki.debian.org/UnattendedUpgrades