I always recommend to isolate iis on the SMP so that it only onllows its localhost IP as well as the actual IP of the SMP during upgrades. This allows you to disable any upgrade polciies that maybe enabled before or during the upgrade.
You would then clone the SMA upgrade policy and target all site servers with it. After adding their IP's to the iis allow list, they will upgrade their SMA's. You can then upgarde their site services.
You can then test other actions against the site servers before removing isolation and enabling the default SMA upgrade policy.
Once all clients have upgraded their SMA's, you can then target the estate with solution agent/plugin upgrades.
All of this should first be carried out in the test lab that mimicks the production environment.