The march patch is applied to the Hyper-V host and will not cover third-party products.

When you have KEK update issues, most likely the platform key is not submitted to Microsoft or it is even a locally generated one (you can check with Powershell in a VM hosted there). In that case, there is nothing Microsoft can do to push the updates, so you'd have to manually enroll the KEK or live with it not being patched.