There may be countless justified situations why auto-installing updates may be undesired. For example, the user is on a trip, out in the field, out working somewhere, and it is absolutely crucial that the phone keeps running and there is zero chance of it breaking or, which can be disruptive too, changing behavior, due to some change in the system, and a system update can easily be such a change. Any update can break or change behavior of things, regardless of how well it was tested.
Currently, the only workaround is to disable the updater service (which is what I do). It works, but it's ugly: you won't get notifications about new updates becoming available, and overall it's not how it's supposed to be. You'll have to reenable it from time to time to get new updates.
Having a "download updates but ask before installing" option would be super nice.
There is an issue about this in the tracker, too: https://github.com/GrapheneOS/platform_packages_apps_Updater/issues/91.