patchman VS foreman

If monitoring is your primary concern, check out Patchman. As others have mentioned, an Apt caching solution is the way to go for bandwidth savings.

Patchman might be something for you.

Currently I am aware of https://github.com/furlongm/patchman but it's old software still using python2 and doesn't really take into account specific package pinning priorities. I also thought about using Ansible and/or Saltstack but both of those require SSH connection or custom TCP session in Salt case.

I was confused because there is https://github.com/ddollar/foreman and https://github.com/theforeman/foreman

In case you're unable to use intune, a free approach might be https://theforeman.org/ That works well for provisioning baremetal windows (with discovery image or pxe boot) once you've set it up. It supports script access as well as a nice hierarchy for configurations. But it's really not as well documented as it should be.

I use the foreman with puppet and pxe/kickstart scripts to automate VM/baremetal provisioning etc.

It comes from the remote execution user snippet: https://github.com/theforeman/foreman/blob/develop/app/views/unattended/provisioning_templates/snippet/remote_execution_ssh_keys.erb

KVM & Foreman

Might want to look into https://theforeman.org/ if it's not too complex for you

The iso images are typically locked at a certain verison. The update repositories sounds like what you are looking for to cache updates. Look into theforeman.org and specifically the plugin Katello. This is an upstream for Red Hat's Satellite product. Another option would be Canonical's MAAS. Both of these options Sound like what you are headed for unless you really just mean synchronize into a folder and store the images in which case yeah.....just use rsync.

Alternatively, you can use Foreman+Katello, the upstream base of Satellite, to get started in learning the platform. You can also use the component matrix to use the versions that most closely resemble Satellite.