I believe it is OK to update the VPS (try doing a manual update and see) but I don’t believe you can’t do a program update using a limited user account as that would effect all users.

You should be able to deal with detected infections and send them to the chest the main restriction I would say would come from windows if you didn’t have enough permissions to move a file from say the system folders. Even in a user account with admin permissions files in the system folders are protected by windows and you need to take additional measures, like scheduling a boot-time scan and that can’t be launched from a limited user account.

This you could test by downloading the eicar virus test file, you would need to pause the web shield to allow it to be downloaded first (leave it enabled and see how it reacts). Depending on the eicar file type, com, zip, and the standard shield settings, etc. it should alert on saving to the HDD.