archvile77 I thought this only applied to system/OS updates, not individual app updates.
The base system is updated by the System Updater, using alpha/beta/stable channels. The GrapheneOS apps (Vanadium, PDF Viewer, Auditor, Camera) are updated via the Apps app, also using alpha/beta/stable channels (launch the Apps app, select an app, use the ⋮ menu, choose "Release channel"). The F-Droid app updates things however it updates things (I don't know); the Google Play Store app updates apps via progressive random roll-out. Each thing that updates apps does it according to its own mechanisms.
Most users can just leave all the settings at their defaults, and will receive updates promptly after they have been tested for a couple of days by adventurous users. Almost all users should avoid removing any privileges from, or disabling, any of the pre-installed GrapheneOS apps, and should avoid disabling notifications from any of them.
Some users choose to remove privileges from, or disable, some Google code, but that is fairly likely to result in puzzling behavior a week or a month later, so it's arguably a good idea not to do that without maintaining a written log of what was removed/disabled so you can put it back later when something puzzling happens.
Please note that I do not speak for the GrapheneOS project.