Each snapshot is a compete index of the data required to represent the file system at a point in time. Apart from the shared data space, the snapshots are totally independent of each other.
You are thinking in terms of deltas, but zfs snapshots are not deltas. They don't contain any of the actual data so there's no benefit in doing it that way.
I don't know if a signal is sent to the system, which can be intercepted, as in the case of shutdown (WM_ENDSESSION) for example, or a event you can get from the log BEFORE the update is launched.
You could very crudely do a scheduled (batch) search for updates.
If they exist, take a snapshot and then apply them.
There is a (not free) software ...
Identify the latest two snapshots for a given dataset (creation, newest to oldest)
zfs_latest=`zfs list -H -t snapshot -o name -S creation | grep ^tank/example_dataset@ | head -2`
Identify ALL snapshots for a given dataset (creation, newest to oldest)
zfs_delete=`zfs list -H -t snapshot -o name -S creation | grep ^tanks/example_dataset@`
Remove latest ...