Cloud Device Administrator is the new role that will provide this capability . This will be generally available in the coming months
246 votesplanned · AdminAzure IaaS Engineering Team (Azure IaaS Engineering Team, Microsoft, Microsoft Azure) responded
We are planning several improvements in this space that will enable better control over updates which are applied to VMs.Ben Hos commented
This would be perfect for our remote class, Intune managed, Azure joined devices!