How do provisioned apps get updated?

Yes, that'll be the only time when apps have a chance to be updated, unless, you open other doors, for example make a business Microsoft store and add the apps you want to that store, so instead of allowing users to have full access to all available apps, only let them access the apps you choose.

You can see here which apps are available to be added to a private business store:
https://businessstore.microsoft.com/en-us/store

more info:
https://docs.microsoft.com/en-us/microsoft-store/sign-up-microsoft-store-for-business