Hi
I know you don't have a large setup but I would look to deploy WSUS in your environment.
Once WSUS is up and running you can patch the clients machines automatically, and patch the server and Exchange server manually.
I only apply Critical and Security patches to the servers and never had any problem. I never touch the .net framework as it always creates problem.
Once you have WSUS you can create update groups where you can filter certain types of updates which makes easier to check and approve.
Thanks