I would say to take advantage of the options within the Scan and Repair settings.
You can use the use deferall options available within the "Repair Options" section, and you can also use the "Maintenance Window" options in order to say not to install the patches unless the computer is logged off.
You can warn the user that updates are going to take place, and to ask them to log save any work they are doing and log out for the next X minutes, etc.
Hopefully this helps.