Ideally there should be a "latest minor version" option with the same logic as the Software Update profile when you enforce a minimum OS version during enrollment.

And a separately configured minimum major version would complement it nicely.