Several years ago; when there was a almost-global "storm" that affected multiple customers, many MVPs and other experts in CM kind of quickly banded together and made multiple methods for preventative maintenance. Some of this is repeated, some of this might be old now: but start here:
https://www.deploymentresearch.com/fixing-wsus-when-the-best-defense-is-a-good-offense/
What we use internally are multiple things; I'm not going to claim it's the absolutely perfect and right thing to do; but just saying this is what we've ended up with:
https://tcsmug.org/blogs/sherry-kissinger/512-wsus-administration-wsuspool-web-config-settings-enforcement-via-configuration-items
https://tcsmug.org/blogs/jeff-carreon/513-what-s-sup
But, please read the original at deploymentresearch.com; do your own evaluation of what might be best for your environment.