That would be a pretty good solution.
But I fail to find this filter option, it should be somewhere in Profiles is that correct?
When googling I did find the support page for Linux but not Android : https://www.soti.net/mc/help/v14.1/en/console/reference/dialogs/profiles/linux/profile_actions_assign_filters_linux.html
If you want to protect your device from executing the package a second time you can simply avoid it by creating a filter in your profile (where the firmware package is located).
Create a filter, so that it doesn't match to devices with OEM version = "XYZ". The profile should not be assigned to devices with this OEM version after upgrade.