Do the users need to decide to apply, and actually apply, all the patches regarding vSphere?

Yes. The customers need to decide if they should apply a patch and need to actually apply the patch if they should. Use tickets to ask for patches and/or binary files. For how to get them, see the steps to get a patch/binary file on the following site: Solution Guide - vSphere Patch application guide - Patch/binary file acquisition.