I would recommend Microsoft’s System Center Configuration Manager for handing out updates/patches/fixes. This will permit you to manage what systems & who gets the updates. You might also consider other FTP servers that integrate with AD and maybe implement group policies to meet your objectives. I don’t know any solution for this so if you find one, maybe post your solution here.
I’d recommend setting this up through the web server. Doing this through an FTP server will be pretty complex. Setup a site which requires a username and password for each user, and have a database which tracks what user gets access to which file.