If we’re talking about macs, what you’re looking for is munki + AutoPkg. There are community supported recipes for pretty much everything out there, and for light touch management you can set the munki policy as a “managed update” - that is, munki will keep it updated if it finds it, but there’s no forced install or locking down.