Best practice for keeping Windows 10 IoT Enterprise LTSC 2021 patched

I'm unclear what the best practice is for keeping WinIOT clients (domain-joined Optiplex 3000 managed via on-premises private WMS) up to date.

There is an option in WinIOT 2.x settings for a Windows Update Server but it doesn't seem to lead to the clients registering and long-term we'd rather reduce reliance on WSUS anyway.

Is it best simply to have an IT team reminder every 'Patch Tuesday' to download the latest cumulative updates from the Microsoft catalog and manually create App Policies to push them out to all clients?

I've been using the following search - "cumulative update ltsb x64 21H2"

https://www.catalog.update.microsoft.com/Search.aspx?q=cumulative%20update%20ltsb%20x64%2021H2

and keeping an eye out for Servicing Stack updates for 21H2 x64 though I think these are now rolled up into the CUs anyway.

Also set up a suitable 'Driver Update Notification' alert from Dell at https://www.dell.com/support/home/en-us/drivers/subscription/    

Interested to know how others tackle this issue.

Thanks,

Mark