For applying only patches that pertain to security level, you will want to use vum and a custom baseline:
1.Go to Home>Solutions and Applications>Update Manager>Baselings and groups
2. Right click in Baslines window
3. Name it $whatever$ and ensure that Host Patch is sleceted in baseline type
4. Type dynamic
in Criteria you will want to have it looking something to the attached photo.
Exclude anything you don't want(note the screenshot shows all security, even low to moderate) and finish out the wizard. From there on it is just attaching the baseline to the hosts and clusters needed.
Personally I would say apply 5.1 U3 unless there is strong reasoning not to, there are multiple performance tweaks that can help, as well as other optimizations done to vCenter and the Web Client.