I'm an advocate for patching via the CLI. For me it typically makes it a much quicker process. I can patch multiple nodes at the same time while picking and choosing the orders for redundancy. With two nodes you wont benefit from the parallel time savings but you do get to see patch fail/success status directly from the CLI session. This allows you to choose your next action with future nodes.
1. Each nodes will restart after the patch has finished installing. If doing this from the gui then the first node will patch first, then the second will patch. If you wish for more control in the process you can patch via the CLI and ensure the first node is up and functioning prior to patching the second.
2. Doing this for zero downtime would depend highly on how your NADs are configured. Hopefully they are configured with both A and B radius servers. If configured for two servers then failover would rely on the radius timers set on NADs or their default timers. If you have very few NADs you could manually remove radius server A, patch, add A back, remove B, patch, add B back. For any deployment I have worked on this would take far more time than worthwhile.
3. I will defer to someone else on this as I'm not sure how a failure is handled in a two node deployment. I have had patch failures on multi node deployments (never the initial node) and the process continues on to the next node once marked failed in the gui.
4. To patch via the CLI you do not have to deregister, the nodes will continue to operate on mixed patch levels but would not recommend continuing this way for an extended period.
