Apple Update server names - iOS devices & tvOS devices
Solution 1:
I would recommend three steps.
- Set up two caching servers per 1,000 devices you have on your network. Any recent Mac can run caching server, just needs a cheap external hard drive to store 250 GB or more of data. We use 2 TB drives as they are super cheap.
- Have your network team allow outbound traffic to all of 17.0.0.0 network. - https://support.apple.com/en-us/HT210060
- Profit
The caching servers ensure you only download one copy of each app, each update and no longer can have any sort of overload or denial of service when many devices all arrive and check for App Store or other downloads.
With the latest OS you will literally be breaking how the security works if you can't check for notarized apps and revoked certificates that have malicious software. Also, just not patching your devices is a risk. I would reach out to Apple for help, any workplace with a few devices qualifies for assistance from a local Apple store or direct from a corporate team to help with this.
Content caching needs to reach out to lcdn-registration.apple.com
Today that points at st11p01su-lcdnreg.isu.apple.com.akadns.net which has address 17.164.1.29
There are about 19 other names in the KB above for all updates to run.