If deploying session hosts from a golden image on a monthly basis, what do you do with defender definition updates? Just update once a month?

Typically default - let Windows install Defender updates as needed. If you disable Windows Updates though, you could script updates via a scheduled task out of hours

We force updates of both Defender client and definitions and perform a quick scan in the gold image, then let defender update definitions at will to ensure full coverage during the month.