If you click “download updates,” BP will initiate the download of updates on the target computer. BP will *not* initiate the installation. BP will *not* ever install the updates unless you tell BP to install the updates. If updates are installing automatically at some later date, then it’s due to the policy that you have setup on the target computer. It’s not related to BP.
If you click “download + install updates, BP will initiate the download plus installation of updates. Yes, some updates require the machine to be restarted before they are officially/properly installed. And so in that case the machines will be waiting in a pending state where the updates are not completely installed, and the machine is waiting to be rebooted to complete the installation. It is generally not recommended to delay the restart because the machine, in theory, could be in an unstable state, and also could still be open to any vulnerabilities that you intended to close with the installation of security updates.
-Doug