How can you use the ONLY_BILL_FIRST_AUTHORIZER feature for updateauth?

If you are doing the transaction with cleos then you can just do this:

cleos push action CONTRACT ACTION DATA -p ACCOUNT1 -p ACCOUNT2

In this example, ACCOUNT1 will pay for the resources

You can refer to how bloks.io does. They use dummy action payforcpu and include it as the first action of free transaction. (Transaction can have multiple actions) You can make dummy action with any name, and include signature with the account which you want to make pay resources.

eosjs may check whether dummy action exists in contract ABI, so you need to deploy contract with dummy action, or write transaction by yourself and sign manually.

actions: [{
  account: "SOME_ACCOUNT",
  name: "payforcpu",
  authorization: [{
    actor: "ACCOUNT_YOU_WANT_TO_MAKE_PAY",
    permission: "active",
  }],
  data: {
    /* ... */
  },
}, {
  account: "eosio",
  name: "updateauth",
  authorization: [{
    /* ... */
  }],
  data: {
    /* ... */
  }
}]