I think he wants to do server side, not client. And that the dns filter picks up those ip addresses or ranges, and let some through.

Or uses a device that rotates mac

Nice. You you restore often?

How often do you do this?

Here’s the wiki article - never had an issue following that

https://wiki.debian.org/UnattendedUpgrades

Can also suggest reading the man page. For completeness and just general knowledge also read the man pages for apt, apt.conf