Deploying Keynote, Numbers etc

If you continue to have problems with it, you might try not baking apps like Pages, Numbers and Keynote in at all. I send them out packaged. When I'm ready to send out any updates, they usually are released to production about a week after they drop from Apple (after some testing).

That way your users don't have to worry about updating in the App Store at all and always have the latest versions (or close to it).

You can have a managed Apple ID in your _MASReceipt to tie in versioning with the App Store, but you'll have to manage the patch level since the App Store will see your managed Apple ID as a different user from the end user. I manage labs so this is not a problem but might be a bigger issue with admin 1-to-1 users.

I have also found that you have to keep a pretty close eye on which versions of Pages, Keynote and Numbers support which OS's. I used min/max settings to limit the likelihood of the wrong version installing to a mac.

That's sensible advice, and what I might have to do. It annoys me that I have used this method in previous versions of OSX without issue. Only now, when I'm building Sierra images for the first time, am I seeing it.

The "Apple way" of doing this is to get VPP licenses for these apps for all of your computers. You are entitled to them as long as you have proof of purchase. We used to do what you're doing, but it stopped working so well somewhere around 10.11.5. Using a blank _MASReceipt file, users were being told there were updates even though there weren't. We've started distributing machines without those apps and now have them available in Self Service using device based VPP licenses. It's working well for the most part.