Or give the user the choice when first powering on the device.

Select: Base version that will only receive security updates. No changes in features. OR All updates

Edit: By "Base version" I mean the first software version for that device.