Head-to-head is the first tiebreaker but does not apply to the Bills and Broncos since they didn't face each other this year. Next would be conference record, so you're right.
Assuming the Bills win their remaining four games to get in, their AFC conference record would be 6-6. Denver would have to lose two of their remaining four games (all of which are AFC tilts) to finish 9-7. This scenario renders the conference records meaningless, obviously. Currently, the Broncos are 4-4 vs. the AFC. If they end up 10-6 then they would be 7-5 in the conference by virtue of their 3-1 finish vs. the AFC. This would give them the tiebreaker over the Bills (6-6 in conference).
To sum up, the Broncos need to lose two more for the Bills to beat them out.