Scripting

Here is a query that will return those computers that require a BIOS upgrade:

SELECT MACHINE_ID, MACHINE.NAME, APPLICABLE_UPDATE,
 DELL_PKG.NAME, DELL_PKG.DESCRIPTION
FROM ORG1.DELL_MACHINE_STATUS
JOIN KBSYS.DELL_PKG on DELL_PKG.PACKAGE_DID = DELL_MACHINE_STATUS.PACKAGE_DID
JOIN MACHINE on MACHINE.ID = DELL_MACHINE_STATUS.MACHINE_ID
WHERE DELL_PKG.COMPONENT_TYPE = "BIOS"
AND APPLICABLE_UPDATE = "UPGRADE"

This query will work for a smart label:

SELECT MACHINE.NAME AS SYSTEM_NAME, SYSTEM_DESCRIPTION, MACHINE.IP, MACHINE.MAC, MACHINE.ID as TOPIC_ID 
FROM MACHINE
JOIN DELL_MACHINE_STATUS on DELL_MACHINE_STATUS.MACHINE_ID = MACHINE.ID
JOIN KBSYS.DELL_PKG on DELL_PKG.PACKAGE_DID = DELL_MACHINE_STATUS.PACKAGE_DID
WHERE DELL_PKG.COMPONENT_TYPE = "BIOS"
AND APPLICABLE_UPDATE = "UPGRADE"

Once the smart label is in place, you should be able to configure a task chain that will turn off BitLocker and then apply the update. In our environment, BitLocker is enabled with Group Policy, so it automatically turns back on the next time the device updates policy. The MBAM client checks in every 90 minutes, I think, so that's normally enough time to perform an operation before it turns back on.