Basically, I want to schedule upgrading ~100 workstations regularly. I only really need specific packages upgraded automatically (the rest can be done manually as required) but because the machines have never been on a standard update cycle they all have different version and dependencies, I cannot just apt-get upgrade package-x package-y package-z.
I was thinking apt-get -y dist-upgrade as a cron job would work, but I am afraid of upgrading to broken versions of a few specific other packages (such as systemd). I could use apt-mark hold package-a to prevent it from being upgraded, but I was told dist-upgrade overrides all holding marks.
What is the best way to upgrade certain packages across multiple machines that have different dependencies, while avoiding upgrading certain other packages?