Assuming you're meaning Windows 11 devices, In Intune, head to 'Devices \ Manage Updates \ Windows Updates \ Update Rings'

From there you can create a policy that automatically applies patches to any targeted devices using Windows Update for Business. We use the same scenario and this is our current config for most of our estate

Note we have other policies that are aimed at other devices for various reasons, for example reboot behaviour and these are grouped and excluded from the above 'global' policy