The Cloud Services Appliance does not patch clients! It does establish a secure connection to your core server, and your clients connecting to Cloud Services Appliance will be requesting those patches. Note that for the patching to work, you need to have the patches on the core server and http path for the patches is enabled (default setting).
Due to security reasons, you cannot push anything to the clients through the Cloud Services Appliance. But the clients can pull down packages, patches (client request).
As for the test, configure the device with an agent and a brokercertificate as documented and run vulscan (with /showui if necessary if you start it from command line) and see if it connects and downloads/installs the patches.