With encryption in place the only thing that really is encrypted is the data partition.
OS updates don’t affect the data partition, and TWRP doesn’t need access to the data partition for tasks which don’t affect it.
So, theoretically, using the built-in Updater should work just fine.
I never use the built-in Updater, however, so I can’t say how this works out in practice. Just try it.
If it doesn’t work this way for you, you can
- try a different TWRP version, or
- download the new OS build to the SD card in the phone (if there is one) and install it with TWRP, or
- use TWRP’s ADB sideload feature and push the OS build to the phone from a computer via USB using ADB.