You can either configure unattended updates (e.g. cron-apt or unattended-upgrade), or you can give system administration privileges to other users so they can accept pending updates. I don't think the latter is granular enough to only allow package upgrades, it also allows installing/removing packages.

That’s surprising to hear. It’s been many years since I ran Ubuntu, but I never get a password prompt for the updater on Fedora.