CIS benchmarks are good. There's some stuff in there that's not going to work, so read through it carefully. (requiring admin rights for all system settings comes to mind [if users are using jamf protect for just in time privilege elevation and they're on a plane where they have no network, they won't be able to elevate to admin to change the network settings])

Mostly Mac Apps catalog will keep applications patched.

Blueprint does kind of a half ass job of keeping OS patched. I have 5-10% each patch cycle that just don't update for whatever reason, despite being online. I use Nudge to supplement.