Alternately, if your organization can dedicate the resources to the Macs/users in question, you could readily replicate non-hardware-specific system configuration in a virtual machine and snapshot before OS updates. That's also great for other kinds of testing.
Otherwise, I'll echo what others have already said here - leverage reposado's ability to distribute different branches. Don't put something into your Production branch until you've tested it. You can even split off certain categories of users into separate branches for additional discrete patching regimens; say the graphics art team wants to avoid system updates that may impact the drivers that run their Wacom tablets and the CAD designers don't want their video cards to get borked, so you could have ART and CAD branches and point machines to them.
Then the trick becomes deciding how you want to point your devices to software updates - if you keep it simple you can have policies set the URL for machines per category; if you have the resources to host multiple servers one per branch then you can cascade out the branches to each server and use network segments to map the clients to the servers.
