I am unsure if you have solved this, but I haven't found any articles. I
just created a policy that searched for the app and killed/deleted it if
it were detected, seems to be working just fine for me
It would appear that running sudo softwareupdate -l (to just list) sudo
softwareupdate -ia (install) So i would imagine you don't need a
password for system updates including iLife/iWork from Disc installs.
Although apps are another situation.
