block the device if it is not up to date

Can you give more detail? Blocks them from what? And what specifically needs to be up to date? The macOS? An application? All applications?

Do you mean something like a Conditional Access system based on e.g. Intune?

@gbourse Depending on type of organisation, but if you work in a informal one check out the following blog from @mikevos https://www.jamf.com/blog/not-forcing-updates-kinda/ it will make you laugh

Thanks for the mention @txhaflaire :)

If this interests you @gbourse , you can find the setup on my github.