You could use eg Puppet (or Saltstack/Ansible/Chef etc), with local (internal) repo servers.
It can update systems automatically and optionally restart any assoc service that depends on the update.
We tend to go for semi-manual restarts for kernels because that requires rebooting the entire machine. VMs are usually pretty reliable coming back, but Real Metal systems sometimes misbehave ...
Similarly for base libs like glibc.
HTH
|