What is the meaning of the different Unattended-Upgrade::Allowed-Origins?

Sounds extremely basic, yet I could not actually find the meaning of the different options available to configure unattended-upgrades... In particular, what is the difference between these two ? "${distro_id}:${distro_codename}"; "${distro_id}:${distro_codename}-updates";

[Edit]: One good source of explanations can be found here (thanks @muru): https://help.ubuntu.com/community/UbuntuUpdates but I haven't been able to find an explanation anywhere for what the first line (without '-[type]') refers to...

I've noticed that having the first line activated will automatically update MySQL for example. If not, I get MySQL packages as 'available but not updated'... I want to go for option 1, but I'd just like to understand why ! :)

The first line was added in unattended-upgrades package Version: 0.90ubuntu0.1:

Modify data/50unattended-upgrades.Ubuntu such that the release pocket is an allowed origin so that security updates with a new dependency will be upgraded and the new dependency will be installed.

from: https://www.ubuntuupdates.org/package/core/xenial/main/updates/unattended-upgrades