We have a 30 Day software update deferral on our production machines set by a config profile.
Most of our macs are running 10.13.4 or higher.
Yet today it looks like Safari 12 went out to a good portion of our Macs.
Is any one else seeing this? The 10.13.6 update was definitely deferred.
Some Security updates can contain the safari updates
While Don M is correct on the "Apple" recommended way, I found a machine booted into recovery and grabbed version 11 of safari for a BYOD user that really needed it .
Safari is an SIP protected app. Not sure it's a good idea to advise tampering a core macOS app.
In any case, not my pig or farm, I was just responding to a post that didn't get any responses. Lazy day. LOL