This is just pure speculation as I've never tried to use the package installer API myself:
You could try to set an installer package for your device owner app (using PackageManager.setInstallerPackageName()). This installer package would need to be a separate APK signed with the same certificate as the device owner APK.
getPackageManager().setInstallerPackage("<device.owner.package.name>", "<installer.package.name>");
From your installer APK, you could then use PackageInstaller to prepare an update:
PackageInstaller pi = getPackageManager().getPackageInstaller();
int sessId = pi.createSession(new PackageInstaller.SessionParams(PackageInstaller.SessionParams.MODE_FULL_INSTALL));
PackageInstaller.Session session = pi.openSession(sessId);
OutputStream out = session.openWrite("app");
// .. write updated APK file to out
session.fsync(out);
session.commit(...);
session.close();
I'm not sure if this silently installs your update though (or if that works at all in the way I would have expected).