Windows updates in a lockdown environment

Hi,

I have a Windows Server 2019 Azure VM in a lockdown vnet. I only allow certain outbound traffic from the VM. What do I need to allow in order to have the VM updated on regular basis? The outbound connection is controlled by Network Security Group the VM belongs to. It seems there is no Windows Update service tag to utilize. I can't imagine open up the outbound connections based on a list of IPs. How do people get around this?

Thank you.