Is this for both Intel and Apple-silicon?

Thank your for this Information.

If you always want your Macs to update to the most current Version that is available to them you could also run a script check for the Version they can see with:
softwareupdate -l | grep Safari | grep -o 'Safari[^[:blank:]]*' | head -n 1
if there is no Safari update available this will return an empty string.
Based on this you could create an interaction with your User to tell them to close Safari and automaticly start the update.

Which would probably reduce your work load but you will lose the option to actually not update Safari if you do this fully automatic.