The dnf-automatic provides two types of updates: default and security. By default, upgrade_type is set to default. I suggest using upgrade_type=security. It will only download and apply security updates and patches without breaking your packages.