For us, lazy admins, there's cron-apt in Debian based distributions. I believe, that there's something like cron-apt available in more distributions also.
(It's still in Stretch though, so you don't have to switch to unattended-upgrades until at least ~2022. https://packages.debian.org/stretch/cron-apt)
Or the redneck version: Have a metapackage in your own repository that uses dependencies/conflicts to pull/remove the packages you want.
The metapackage is the only one that's explicitly installed, ever. (Except for workstations where I might install applications to test them.) Part of system maintenance is to clean out orphaned packages every once in a while, usually as part of the system update.
Combine it with config packages (using something like configure-package-dev from debathena) and you have a very nice little config management system.
Same here. One day I'll get around to migrate everything to Ansible… one day…