for sure you know the recommend approach to use always latest fixes and versions to run the most stable and most secure code base.
Assuming you have a good reason to get only the “older” fixes you can use a command line parameter of SUM called: -showAll true
Recommendations are certainly good to have (many thanks for not using the ill-advised “best practice” term here ) . They are useful guideposts for others to consider. But the latest is not always the most stable and the most secure. It is simply the latest.
My recommendation is: 1) periodically apply the latest fixes, at a time convenient for overall activity; perhaps monthly or quarterly, avoiding “busy” times when issues introduced by the fix/patch would be a disruption; 2) apply specific fixes that explicitly address observed symptoms as needed.
A common approach (prompted by support usually) when an error or symptom is encountered is “apply the latest fixes and see if that corrects the problem.” IME, it almost never does.
One of the downsides of applying the latest fixes is that, more often than SAG (and vendors in general) may care to admit, the fixes themselves introduce other problems. In the worst case, not only does “the latest” not always address a problem at hand, it introduces another that you now need to chase.
Certainly security fixes warrant attention. But in general, unless a fix addresses a symptom that you’re explicitly experiencing, it is fine to skip it.