I don't think there is an article that states this information, but you can simply start testing with the least privilege for a user role and check whether the user has access to F5 updates or not.
I think F5 updates might require one of the admin roles. Take a look at the below article for each user role on F5 and start testing to select the role with the lowest privileges but has access to F5 updates.
