Limit automatic updates to software and applications only, but not OSX I manage several Macs, and from a security point of view i would like to make sure they where always up to date with the latest patches for their version of OSX.

I understand there is an inbuilt tool in the "mac app store" application to do this. 

My concern is that the auto update tool would auto update these machines to the latest version of OSX. eg. Sierra. Because we have to run some mission critical software on a few machines we can not upgrade past Yosemite at the moment so i wouldn't want the auto update to upgrade OSX. Is it possible to get the auto update to upgrade applications and patches, but not OSX itself ?
It will not automatically update to Sierra.  It will alert you, and will download in the background (one of the "features" they copied from Windows 10) but you have to click on the "Install" button to install it.  

I am running El Capitan with everything set to Auto Update and not once has it tried to install Sierra.  However, the way I got around it was that I downloaded it to make a USB Installer and left it in place.

That said, you can turn off the background downloading of automatic updates.  In System Preferences --> App Store:



You also have the option to install app updates and OS X updates, but it will download items in the background.