I have the scenario to prevent user access to all SharePoint 2010 websites within a time Slot, while patching the farm and installing a cumulative update (CU). I found a best practice here for how to patch: Recommended way to install CU and Update on SharePoint Servers
But I have the additional question: Would it be okay, to stop all IIS web sites in the IIS Manager on both web front end Server (WFE) to prevent user access while patching the farm? So my idea is to simply prevent the user by accessing the farm and prevent them from doing modifications on Content. In the meanwhile the IIS web sites are stopped, I would like to install the CU and then run the configuration wizard to finish the Installation.
Does this affect the patch process or is it okay and the patch can be installed even if the IIS web sites are stopped?