This is a little off topic of the main discussion here, but...
You can do on-demand patching with the agents. From Protect go to Machine View or Agent Manager, and you can right click > choose Agents > Run task from policy > then choose the patch, threat, or asset task you want it to run.
It's a little more limited because you cannot specifically choose the patches to deploy. It just runs the task based on what is set up in your policy, but you can create multiple patch tasks for different purposes to make this a little easier.