"Request install packages" was the final piece! saving the apk to app-specific folder works but so does downloading to shared documents folder. I prefer the shared doc folder because user can find those downloads if something goes wrong.
With that setting, when the app calls the intent to install update, I get a window that says the app does not have that permission, but a click takes me to the settings where I can turn on the permission, then go back to app and click install.
This is a major win for my app! Thank you so much.
I will definitely check out Device Lens. Thanks again, happy weekend!