Trevor already give you details on this. I tell what we do.
We prefer CU on security patches but if there is service pack then that is our priority. We never install every cu unless it fix one of the issue related to our farm. As CUs are cumulative and contains previous cu fixes, So we apply CU in our farm every 3rd quarter.
Reason, this required down time, also require testing and sign off from customer after testing. Which take couple of months. So we schedule everything in advance and perform hard testing.
I would not recommend to install security patches via Windows update, due to config wizard requirement. Also during the installation of patch farm goes down and can cause corruption of data if user are working.
It should be a controlled manner,
- pick the cu which u want install
- test in lower farm and ask customer do testing
- sign off from customer
- schedule production
- take the farm backup before applying CU in case DR you can recover it.
Rest you decide upon your own requirements and limitations