Is it a best practice to use the default collections that are generated when publishing a patch update.
Does the solution auto-filter the machines that do need the patch(es)?
default collections to a pilot or test collection. That way if something happened, only a small list would be affected. Altiris is designed to apply only applicable and required patches to a system, to ensure unneeded updates aren't sent.