Schedule content updates so that they download-and-install automatically. Then, set a Threshold that determines the amount of time the firewall waits before installing the latest content. In a mission-critical network, schedule up to a 48 hour threshold.
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/software-and-content-updates/best- practices-for-app-and-threat-content-updates/best-practices-mission-critical#id184AH00L078

Because new WildFire signatures are now available every five minutes, it is a best practice to use this setting to ensure the firewall retrieves these signatures within a minute of availability.

https://www.paloaltonetworks.com/cyberpedia/what-is-a-zero-trust-architecture