I have worked on any on premise SharePoint 2013 servers. and I also follow this approach when installing SharePoint security update or full CUs:-
If our customer have test & live environments. We first install the updates (either SP security or full CUs) on test environments, do a full test by adding, editing, delete data , check all the views ,managed services etc.. then based on the test result we proceed on installing these updates on live. Sometimes we notice that a security update caused some changes/problem inside the test , so we try to fix these on test first or postpone the updates on live if the effect of the update is large.
Some customers only have one live environment (no test) . so in this case our system admin take a full snapshot of the SharePoint server, install the SharePoint updates, we test the SharePoint after the update, and either proceed with the updated SharePoint environment, or restore the server from the snapshot if we find that the update caused some problems that we need to investigate more…
Now the above 2 approaches have worked for us on many projects and environments and we did not face a major problems.
But now we want to start a new office 365 SharePoint project, and seems we do not have any control on installing the security updates as we do on the on-premise environments.. so not sure how we need to manage the security update or CU update inside office 365 compared to on-premise environments ?
second question. now inside our office 365 admin center i find these upgrade options for each site collection:-
so when i chose Yes for Allow Upgrade does this mean that my site collection will automatically have the latest security updates + CUs ? and seems sharepoint will allow me to test these updates before applying them as there is a section called "upgrade demo site"? or upgrade inside Office 365 is different than installing security updates and CUs inside the on-premise ?