Making multiple mirrors seems like the best solution. I will explore that route.
I was hoping there was something built into APT or unattended-upgrades, I vaguely remembered such a feature… what I was remembering was probably Phased Updates, but those are controlled by Ubuntu not by me, and roll out too fast.