why not just configure unattended-upgrades?
create eg 51unattended-upgrades (so it doesn't get overwritten by system updates to the default 50unattended-upgrades) in /etc/apt/apt.conf.d/
Unattended-Upgrade::Allowed-Origins {
"${distro_id}:${distro_codename}";
"${distro_id}:${distro_codename}-security";
"${distro_id}:${distro_codename}-updates";
}
Unattended-Upgrade::Origins-Pattern {
"origin=Enhance,codename=${distro_codename}";
"origin=LiteSpeedTech,codename=${distro_codename}";
}
Unattended-Upgrade::Mail "***@****.**";
Unattended-Upgrade::MinimalSteps "true";
Unattended-Upgrade::MailReport "always";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
then copy /usr/lib/systemd/system/apt-daily-upgrade.timer to /etc/systemd/system/
and edit that to configure when upgrades get applied.
can also do that with apt-daily.timer as well to configure when apt update runs, but that runs often enough by default that there's little benefit in changing that one.
if you edit apt-daily-upgrade.timer in /usr/lib/systemd/system/ it will definitely get overwritten by system updates,
the copy in /etc/systemd/system/ will keep your changes
you'll get email notifications when it completes, with details of what got installed, and if a reboot is needed.
you could also configure it to reboot automatically if needed. i prefer to leave that as a manual step.
and if ssh'ing into each server and running apt update and apt upgrade is too cumbersome and time consuming for you to do for updates to enhance, how do you currently handle normal ubuntu updates, which are larger and way more frequent?