P.S. I haven't yet tried "zypper up -t patch -t package" but wouldn't it do what is wanted? (and in particular, update patches first and any additional packages afterwards, so that "reboot" or "restart" types of patches are handled appropriately)