Windows Update check Powershell Script, syntax in check_mk.user.yml?

Yes and no. Scripts inside the plugin section also need a check script on CMK server site.
What you can do is a local check. This will then be placed inside the “/local” folder and can also be configured the same way with cache age.

Your windows update PowerShell script as local check as an example

$rebootpending = 0
if (Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired") {
    Write-Host "updates installed, reboot required"
    $rebootpending = 1
}

$updateSession = New-Object -com "Microsoft.Update.Session"
$updates = $updateSession.CreateupdateSearcher().Search(("IsInstalled=0 and Type='Software'")).Updates
$criticalTitles = "";
$countCritical = 0;
$countOptional = 0;
$countHidden = 0;

if ($updates.Count -eq 0) {
    Write-Host "P WindowsUpdates critical=$countCritical;1;2|optional=$countOptional;5;10|hidden=$countHidden no pending updates"
}
else {
    foreach ($update in $updates) {
        if ($update.IsHidden) {
            $countHidden++
        }
        elseif ($update.AutoSelectOnWebSites) {
            $criticalTitles += " \n " + $update.Title
            $countCritical++
        }
        else {
            $countOptional++
        }
    }
    Write-Host "P WindowsUpdates critical=$countCritical;1;1|optional=$countOptional;1;100|hidden=$countHidden|reboot=$rebootpending;1 pending updates $criticalTitles"
}