[CentOS] More questions about patch management

I'm still trying to get an idea about how best to handle patches on
CentOS.

Say I want to apply security patches automatically on a nightly basis.
But when the push from 4.2 to 4.3 comes around, I want to defer that for
when I can do it manually.

Is that possible? (Preferably with yum, but I would use up2date if that
were necessary.)

Also, I'm used to doing 'yum update'.  I understand that 'yum upgrade'
enables the obsoletion logic in yum, but practically speaking, when is
it appropriate to use one or the other?

Thanks,
Steve