Eh, updates and security go hand-in-hand. I'd say it would be best to completely split it out. Updates should just contain security update and be mandatory. Some other thing (call them upgrades) should contain new features and be optional.
This is, unfortunately, for a lot of OSs not true. Windows and Android for example combine security patches with normal updates which introduce new bugs.
