Comment by tremon

You can either configure unattended updates (e.g. cron-apt or unattended-upgrade), or you can give system administration privileges to other users so they can accept pending updates. I don't think the latter is granular enough to only allow package upgrades, it also allows installing/removing packages.