I was just looking into this today. I want to keep my computer updated with the cli tool softwareupdate. Before I was using the flag --all to apply any update, but then tried to change it to --recommended as I wanted to avoid any major macOS upgrades (ie Tahoe). But Tahoe is listed as a recommended upgrade.
Now I call it with --required which only applies critical and security updates. Then I call it again with --safari-only, and one more time with --list to see what remaining updates are available. Frustrating (but sadly not surprising) there isn't a way to apply all available updates excluding major OS updates.
Now I call it with --required which only applies critical and security updates. Then I call it again with --safari-only, and one more time with --list to see what remaining updates are available. Frustrating (but sadly not surprising) there isn't a way to apply all available updates excluding major OS updates.