I think that’s the right place. If you want some flag “dont_send_me_major_updates” thats probably a bit more work to do. The update_server will always return one version. I see two ways:
- Pass &dont_send_me_major_updates=1 and only return updates for the same version.
- A more generic approach: Return all available updates for this version. This also requires a new parameter &give_me_multi_version_response=1 because old clients don’t know how to parse responses with more than one version.
For 1 and 2 nextcloud/server and nextcloud/updater need some changes to support the new flag properly. At least 3 pull requests to different repositories is probably a tough start 
./updater.phar --patchFile=nc17.zip --signatureFile=nc17.sig
As start I would extend the updater to accept a specific patch file and the signature via arguments. So people have full control which version is installed.
I identified url, signature, version and versionstring as mandatory information from the updater_server response (probably they are more).
If --patchFile and --signatureFile not empty don’t call $this->getUpdaterServerResponse modify $this->getUpdaterServerResponse to return some information from patchFile. For the version check we need version and versionstring.
Use https://www.php.net/manual/en/ziparchive.extractto.php to extract version.php from the patch file and $version = implode('.', $OC_Version); and $versionString = 'Nextcloud ' . $OC_VersionString;
Probably curl will accept something like ‘file://local/path/to/nc17.zip’ or check is $response[‘url’] a path to a local file and copy it to $fp and skip all the curl rest.
Paste the content of --signatureFile here.
This method is probably a good place to add all this --patchFile and --signatureFile logic. If these two arguements are present do something different but also return a array with url, signature, version and versionString.
I’m not sure but sometimes autoupdate = false. These seems to be related to outdated php versions: updater_server/config/config.php at 03037e2413dcd4e389652f5dfd571991574733dd · nextcloud-releases/updater_server · GitHub
If people are using the updater with a custom patch file I would ignore this flag for now assuming they know what they are doing