For each host you want to update, do the following steps:
Click on the host you want to update, then navigate to the Update Manager tab
Click "Scan...", make sure upgrades and patches are selected, then click "Scan"
When the scan is finished, if there are any patches that can be applied, they will be listed in the bottom half of the screen.
Click the "Stage..." button at the bottom and click through the wizard to download the patches
The previous steps can all be done without disrupting the VMs and can be done in parallel. The following steps should be done one at a time per host.
Migrate all powered on VMs to the host you are not updating
Navigate back to the host's Update Manager tab
Click Remediate
Patches can take a while (30+ minutes) to apply. The host has to boot multiple times, and the huge amount of memory in the host means boot times are long.