Yeah. It’s not that simple. There is no “proper way to upgrade docker OS (bullseye)”.
You can conceivably modify https://github.com/discourse/discourse_docker/blob/main/image/base/slim.Dockerfile to build an image that your IT team will approve. I guess I’d start by using the latest Debian as the base image. I’d likely budget a week to do it, but it could easily take half or twice as long, if the Discourse code base even works with the newer versions (it probably does, but there’s no way to know).
Building an image that works and satisfies your compliance issues will be time consuming and likely more dangerous than using the standard image, which is tested by the Discourse team and works on thousands of sites. You’ll instead by running an image that only you know about. When it’s broken, you won’t be able to get any support here since it’ll be impossible to know if the issue is with the code or some library that Discourse isn’t supporting yet.
Every time you upgrade, you’ll need to budget time to see if the Discourse updates work with your image.
If your IT folks insist on these updates then you should probably consider another platform.