These days in 99 cases of 100 I’d use something like Sqirrel to install per-user and enable self updates. But it’s still and executable and I still think Windows Defender will react poorly to an unsigned one even if it isn’t going to need any elevated privileges.