Thanks for the information. I'll try it with "VMware"/"Any" for now and see how it goes.
It seems incredible that VMware won't allow us to select only those patches that are relevant automatically. It's not as if they haven't already built the mechanism into the product, after all. It seems similar to a lot of other things we're coming across in vSphere 5.1 (we're in the process of migrating from 4.1), half-baked implementation and/or buggy.