We have three Netsus virtual appliances set up to handle Software Updates. I have it set so new updates get downloaded, but not activated until I've been able to ensure they are safe. Once a week I got in and check them out and if they are ok, I activate them.
From the client perspective, I have a network segments set up and each segment is assigned to a Netsus. So clients always go to their nearest Netsus to get the updates.
