Any suggestions or recommendations on how others are achieving this?

If I was going to do a mass rollout of SP3, I would push the bundle to all
my zen managed computers, I would then update my image so all new computers
had SP3 as well, but what about any missed computers in this process. Is it
possible to say any computer that comes into this Zen zone - install SP3?