You can install Update Manager on the server on which vCenter Server runs or on a different server.

The Update Manager server and client plug-ins must be the same version. Update Manager and vCenter Server, and the vSphere Web Client must be of a compatible version. For more information about compatibility, see Update Manager Compatibility with vCenter Server, vCenter Server Appliance, vSphere Web Client, and vSphere Client.

Update Managerr has two deployment models:

Internet-connected model
The Update Manager server is connected to the VMware patch repository, and third-party patch repositories (for ESXi 6.x hosts). Update Manager works with vCenter Server to scan and remediate the virtual machines, hosts, and templates.
Air-gap model
Update Manager has no connection to the Internet and cannot download patch metadata. In this model, you can use UMDS to download and store patch metadata and patch binaries in a shared repository. To scan and remediate inventory objects, you must configure the Update Manager server to use a shared repository of UMDS data as a patch datastore. For more information about using UMDS, see Installing, Setting Up, and Using Update Manager Download Service.

Outside of DRS clusters, you might not be able to remediate the host running the Update Manager or vCenter Server virtual machines by using the same vCenter Server instance, because the virtual machines cannot be suspended or shut down during remediation. You can remediate such a host by using separate vCenter Server and Update Manager instances on another host. Inside DRS clusters, if you start a remediation task on the host running the vCenter Server or Update Manager virtual machines, DRS attempts to migrate the virtual machines to another host, so that the remediation succeeds. If DRS cannot migrate the virtual machine running Update Manager or vCenter Server, the remediation fails. Remediation also fails if you have selected the option to power off or suspend the virtual machines before remediation.