You only need to run PMImport to download bulletins; you do not need to download/stage the updates themselves for vulnerability reports to work or create policies for vulnerability reports to work.  However, if you would like to run a compliance report, you will only report against staged updates for which a policy exists.  This is because PMImport downloads new inventory rules which are sent to the client as part of the InventoryRuleCache.ibd file.  This file is all a client needs to evaluate vulnerability, which it reports back to the SMP server.

Altiris knows a computer is vulnerable based on PMImport and the local activity I explained above.  Compliance, however, is based on what vulnerabilities you've asked the client to patch (as a result of policies).  Don't make my mistake and confuse vulnerability and compliance reports!

PMImport is a CAB file containing XML.  It's downloaded to the SMP server by the Microsoft Patch Management Import task.  You have to do this before you can begin using Patch Management to deploy patches/updates.  PMImport is updated by Symantec when Microsoft releases new updates.  You can schedule PMImport to automatically download.  This is where you get the resources for the software/SPs/updates/bulletins, and the inventory rules.  You can view PMImport settings at Manage > Jobs and Tasks, Jobs and Tasks > System Jobs and Tasks > Software > Patch Management > Microsoft Patch Management Import.

Resource Manager lets you view all sorts of information about resources.  Computers are one example of a resource.  Software is another example.  You can view these by going to Manage > Computers (or whichever selection you want), and then expanding the tree in the left pane to display resources in the right pane.  For example, Manage > Computers, then double-click a computer in the right pane to open up Resource Manager for that computer.  Information is stored in something called a data class, so this is where you see all the various data classes.  Play around with the menus for computers with the Altiris Agent installed.  For example, open Resource Manager for one of your test computers, then View > Inventory, then expand Data Classes > Software Management > Patch Management, then expand Microsoft and also Global > Windows.  These are the data classes you should see populated with software updates and various patch-related data.  Are these there?

The patch remediation center is where you can actually work with the Microsoft items that PMImport told Altiris about.  You can find this page at Actions > Software > Patch Remediation Center.  This is where you would stage, create policies, distribute patches/updates, etc.

Regarding supercede concerns: there is a task, called the Disable Superceded Software Updates task.  This task runs on a schedule and disables a superceded software update.  It will only disable an update if 1) a patch is available which Microsoft indicates supercedes an older update and 2) you have added this superceding patch to a policy.  This prevents scenarios like downloading a new patch which supercedes an old security patch, thus halting rollout of the old security patch while you wait to release the new patch.  I hope that makes sense.

A final clarification: in order to roll out a patch or bulletin, you must create a policy.  But a policy can contain multiple bulletins.  For example, I could create a policy called 'MS Security July 2010' including MS10-42, MS10-43, MS10-44, and MS10-45, which includes all of the bulletins released July 2010 by Microsoft.

When you say none are reporting vulnerability data, where are you looking?  Did you find those data classes I mentioned?  It may be basic, but are you sure your clients are licensed with a valid patch management license?