Users will need:
- member of the farm administrators group
- local admin on SharePoint server
- Security Admin and DBCreator role on SQL
- db_owner on all existing SharePoint databases
This blog post lays out additional details and recommendations, including a recommendation to grant these permissions to a group rather than individual users, so that you can add/remove these permissions from users more easily. (though, there are caveats to the group approach, read the post for more details).
Also, the farm service account should not be used to install updates, per guidance from MS. That's intended to be used as a service account, and there should be no need for users to log in as that account. If set up correctly, the farm account should not have local admin rights, and therefore wouldn't have the necessary permissions to install a CU.
Of course, install the CU on a test farm first, ensure you have proper backups, etc.