You shouldn't even need a full screen (something a windows manager can run in) to do this, just a simple LCD display (perhaps 2 lines of 16 characters, like this) to give some directions, and a couple of buttons, one of which is larger than the others and serves as a "return" or "do it" button. Think of the display on an older printer.
As long as the pi is connected to the internet, you can use programming language, curl, or wget, to get a file from the web.
Think of devices like routers which let you know when they need to be updated, and the only option you have is either to download the update or not to do so.
I imagine that on your website you have a directory with one file, which has a specific naming scheme, like "
For example, the 2nd update, updating minor things that was uploaded to the site today might be named update-00.02-2018-07-03.gz
A program would run weekly to check for updates and to see if this update is later than the last update they have. If so, it would download the update, run it, and restart the machine, if given permission by the user.
At least, that's how I would do this. I might also bring out a USB port to the exterior of your machine (they make special cable for this) that could be used in the case that the machine has no internet access.
And frankly, I'm not sure I'd want an expensive machine to have access to the internet. I believe in firewalls for a reason. Just a quick story. I worked for Penn State, and one of our maintenance people was putting the software on a new machine. He forgot to do this inside of a firewall. He was ten minutes into the process when the security people came knocking on the door to tell us that one of our windows boxes was sending viruses out. Sure enough, it was the new machine.