That would do the trick but anyway the Windows Updater Applications group need just "Installer or Updater" permissions. Other Win apps unrelated to Win Update will need braoder permissions, the "Windows System Application" will do.
Read the help file, it's very informative.
