However is it possible take it a step further and only allow certain pkeys (i.e. the testers) to access certain updates before allowing them to be downloaded and installed in production?
Yes, just modify your server-side code to only allow certain tester's pkeys. If you're using LimeLM you can use the feature values to mark which testers are allowed to access the pre-release updates.