Will adding a global rule with the actions - If 'Name' contains 'KB5010793' then 'Approve and Install', work for Out of Band updates? This update fixes the VPN breaking update 'KB5009543'. 

I need something similar, did you work this out????