You must attach a security policy (with UDT configuration) with container profile to the device before you do the upgrade. You can attach a policy with default container profile to get the upgrade through.

sorry posted by mistake

I don't know the models of your routers, but if you have for example ASR1000 router, you can upgrade it to SD-WAN and you can use them for both WAN and SD-WAN, but you need to test this in a lab to make sure you can cover all existing functionality. ...

I would like to know the right answer

The question answers are incomplete (should say % of what), answer is 40% of the interface shaped BW.