Can someone tell me what happens when I push an update to the app to
the Windows Store? Is the app automatically updated and forced upon
the user of the Kiosk app, or does the user get the option to reject
the update?
When your update passes certification, users cannot update your app through Assigned access method and they need to log out of the kiosk-mode. The update can be downloaded in background and get finished when they close and re-launch your app.
There's no option to reject the update directly. But if users turn off Update apps automatically
in Store app setting, they could decide to update your app manually or not:

For mandatory update, you could enable it by checking Make this update mandatory
when create your submission. But this feature requires developers to use the mandatory setting to enforce mandatory app updates in their own code. For example, you could disable some functionality until the mandatory update is installed.