Hey,
if you’re looking for automated, secure updates, I recommend you read my explanation about automatic, policy-based updates in Univention. Yes, you can limit this to only install errata-level updates.
If you need to do it manually, you can use the following command to install errata-level updates. It’s the same the aforementioned automatic update process uses, too.
/usr/share/univention-updater/univention-actualise --dist-upgrade --silent
m.