Installing latest CU update in theory is what is needed. But in practice (as i have mentioned on another blog post) sometimes it for some reason pulls older CU from WSUS, then can't see the newest one until you wipe SoftDist folder and then installs the latest.
We have a practice here to only watch for Security and Critical updates in WSUS. Not sure if C and D still apply. But out of band updates were rare maybe 5 years ago. Now it is very common. I would say i see something not on Patch Tuesday every month. Office updates (2010-2013) usually appear during 1st week (more come on regular schedule) and then i see some more updates on 3-4 week of a month (for Windows). As they are marked as Security or Critical, i can't ignore them and have to approve. We don't do testing for 15+ years now as we didn't have issues with updates to warrant that. But i still have to check/apply/file the change in our system/etc. Would like to see most updates on the actual Patch Tuesday. Why Office updates are released earlier?