Hi,
You can accomplish it with the help of Auto upgrade feature.
1. Create an Install Package that only has 'Virus and Spyware Protection' enable
Ans : Actually no need to create manual package, In SEPM 12.1 you will have to select Basic protection for servers.
2 How to update existing SEP clients 12.1 with the new Install Package? Just push it down and it will replace the current setting?
--> Use Auto upgrade method and assign custom package to required groups, But change Upgrade settings & uncheck maintain existing client features when updating. So that features will changed
https://www-secure.symantec.com/connect/articles/sepm-121-auto-upgrade
3. Regarding to question number 1, would it be better to create a Policy and apply to a group of clients? if yes, then how? I know how to create a new policy but it does not seem to have options to enable only 'Virus and Spyware Protection'.
--> It's not possible with the help of Policy, It possible with the help of Auto upgrade as stated above.