Download MBSA, run it every night, check the missing patches, download and install them.
MBSA => "The Microsoft Baseline Security Analyzer provides a streamlined method to identify missing security updates and common security misconfigurations. MBSA 2.3 release adds support for Windows 8.1, Windows 8, Windows Server 2012 R2, and Windows Server 2012. Windows 2000 will no longer be supported with this release." (http://www.microsoft.com/en-us/download/details.aspx?id=7558)
Get it, write some PowerShell to run it, parse the XML it generates and install the missing patches. This allows for minimal, security-only, updates.