I have filed feedback on this with both the Feedback Assistant and via our AppleCare Enterprise Agreement. This most definitely needs to be two separate MDM payloads, one for normal point updates, and one for major version macOS updates. Based on the response that I have received, Apple knows that this needs to be separated. Keep filing that feedback!