To be as user friendly as possible, always ask if user wants automatic background updates or not. If you can’t update without user noticing it, please implement manual updates as two mechanisms:

1) Emergency update for remote exploit fixes only

2) Regular updates

The emergency update can show a popup, but only once. It should explain the security risk. But allow user to decline, as you should never interrupt work in progress. After decline leave an always visible small warning banner in the app until approved.

The regular update should never popup, only show a very mild update reminder that is NOT always visible, instead behind a menu that is frequently used. Do not show notification badges, they frustrate people with inbox type 0 condition.

This is the most user friendly way of suggesting manual updates.

You have to understand, if user has 30 pieces of software, they have to update every day of the month. That is not a good overall user experience.