Customer may have some mission critical systems, in which the patching to be done carefully, we will call it as ‘Critical Systems’. Customer to identify such systems and configure them under Critical System profile and choose as part of scan and deploy schedule.
For normal end points, customer may wish to perform auto approval and deploy all the missing patches. But for these critical systems, the auto approval setting will not work. Customer to decide what patch they want to push for these systems and approve them manually.
Deployment of patch can be either done manual or in scheduled manner.
Please refer help link Windows Patch Scanning and Deployment Settings on configuration.