iOS Update

We have an application that runs in "kiosk" mode: unattended, under MDM, and in Single App Mode.

To update the application with a newer version, we are forced to:

1. 1, remove single app mode from mdm
2. 2. exit the application (we have a way of doing that remotely)
3. 3. use mdm to push a new version of the app
4. 4. reapply the SAM profile from MDM

as a result the newly updated app starts up.

However, at times an IOS update is pending and when the SAM profile is removed, a dialog pops up asking whether to update the IOS version. This then backgrounds the application making it impossible to exit in step 2, and continue the process until someone manually intevenes.

Has anyone found a way to do this without falling afoul of this scenario?
Some have suggested blocking the updates with a proxy server. Anyone tried this? Does the proxy server have to be installed continuously or just when SAM mode is turned off?

Thanks.