Sometimes you have to go with what the system is capable of, so this is how we do it:
I seldomly use KVM templates as such, I just use VMs due to the fact that templates are not runnable and updateable. I just use "normal" VMs in a template folder and do regular Windows maintenance updates every month on them. For Linux, we just do network PXE installs which is faster than clone, update, cleanup and specialize with a local mirror and years of automation experience.
For containers we have an external system that is able to keep container templates up to date and provides general and special containers in their own storage inside PVE so that you can choose from which container template storage you can take your template while creating a new container.