Very few things out there don’t require an agent. TacticalRMM is a decent self-hosted device management platform, but I don’t really trust them after some controversy with an embedded Monero miner in the agent (has since been removed, but come on).

MeshCentral is what TRMM uses for its remoting and its pretty robust, but doesn’t do patch management on its own. If most of your infrastructure is Linux, you can easily handle it yourself though.

TBH, manual management would be the easiest if your infrastructure is small enough.