How to allow theme update downloads to WordPress installs only?

$_SERVER['HTTP_USER_AGENT'] is something you should not rely on.

This can be anything from:

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

to

☆*:｡゜ﾟ･*ヽ(^ᴗ^)ﾉ*･゜ﾟ｡:*☆ ¯\_(ツ)_/¯(ಠ益ಠ)(ಥ‿ಥ)(ʘ‿ʘ)ლ(ಠ_ಠლ)( ͡° ͜ʖ ͡°)ヽ(ﾟДﾟ)ﾉʕ•̫͡•ʔᶘ ᵒᴥᵒᶅ(=^ ^=)oO

So you need to thinker something other to rely upon.

Why don’t you simply use form action do-theme-upgrade?

File: wp-admin/update-core.php
336: function list_theme_updates() {
337:    $themes = get_theme_updates();
338:    if ( empty( $themes ) ) {
339:        echo '<h2>' . __( 'Themes' ) . '</h2>';
340:        echo '<p>' . __( 'Your themes are all up to date.' ) . '</p>';
341:        return;
342:    }
343: 
344:    $form_action = 'update-core.php?action=do-theme-upgrade';