Looking for a protected update mechanism for software on a linux-based virtual machine

We use a Linux-based virtual machine with internally developed applications in a cross-organizational area with many different users. The applications and updates are not publicly available, but are currently distributed as a protected download package with installation script. However, this is costly and error-prone. In the future, updates will be automatically requested and executed by the virtual machines. This requires an infrastructure or software that meets the following criteria: - Secure access via user credentials, key or similar options. - control of access for different user groups, so that not all users have access to all applications While searching for such a solution, I could not yet find any software that covers the criteria. I would be grateful here also for hints, for which terms or for which kind of software I can search. The central control and provisioning of clients (opsi, m23, ...) seems to me not the right thing, the clients should not be managed and configured centrally, but these should be able to request the updates. A PPA doesn't seem suitable when it comes to secured access or different user groups. If there is nothing suitable for the purpose, a custom development would also be conceivable. Before that, however, I would like to get as broad an overview as possible of which solutions might be considered. I am grateful for any ideas and suggestions.