On recent macOS versions, the restriction may not apply to major updates like OS updates. Major OS updates can be hidden using the --ignore option of softwareupdate command line tool. For instance, Catalina upgrade can be made hidden by running:
softwareupdate --ignore "macOS Catalina"
to restore hidden updates, run the following command
These commands can be sent to your devices using scripts within filesets.