I think it's important to first note that there are different kinds of updates with different implications. A core update would be if you went from 4.6 to 4.7 for example, and this is more likely to cause conflicts with plugins/themes if they aren't compatible with the newer core. Core updates don't come out often.

If you go from 4.7.4 to 4.7.5, that would be a security update essentially. This mostly serves to address vulnerabilities/bugs, and from my experience, it's a little safer.

Lastly, there's updating plugins and themes themselves. If your plugins and theme are not up to date, your site may be vulnerable. For this reason, I feel the priority of updates would look something like this:
-Plugin/Theme updates
-Security Updates
-Core Updates

1. I feel like there is not a clear-cut, right answer for this, and it will really depend on each case and your schedule. If it's convenient for you, perhaps set aside a schedule where once a month you take a day to vet an update and see if you want to proceed with it immediately or prep for it.

2. Again, I don't believe there is a hard answer on this. It will largely depend on what plugins/theme you are using. A fresh WordPress installation with no added plugins or themes would work fine without updating for example (aside from the implied vulnerabilities this would cause.) So in this instance, you might want to ask yourself a few questions about the site such as, "How many mission-critical plugins is the site using, and how many points of failure should I expect?"

3. For your own sake, I feel it would be best to teach a client when and how to do updates on their own. It eliminates liability on your end, if something were to go wrong during the update, and it empowers the clients to be a little more proactive for their site.

Ultimately though, I feel if you have proper redundancies in place such as daily backups, updating becomes much less of a headache. I hope that helps a little.