Our company will soon have hundreds of vending machines running a custom Debian 7.x based image made with debootstrap.
We want to set up the clients to be automatically updated keep the patch levels up for security reasons obviously, but at the same time we feel that simply enabling automatic updates directly from closest Debian mirror is too risky. We want to avoid the situation where a package that was automatically installed suddenly bugs out on all our machines at the same time (the hardware is homogenous) so a way to hold back official packages is useful.
We also have a few custom packages that we would like to distribute as "official" in our network.
In the future we may add new hardware and we also may want to segment our updates to distribute risk even further.
So how should we configure our Debian client and the repository server to have this kind of functionality?