Upgrade SP 2010 SP2 and Jun 2015 CU in a small farm queries

We have a SP 2010 SP1 scenario production server farm. Will be upgrading SP 13 in a month or two in a separate farm. 

All of a sudden we started receiving strange issues:

• Permission wipes when unique security is applied randomly once or twice per week
• some of the checked out pages disappears, XLST and other designer customization throws error etc.

Now that we decided to go with SP2 with the latest CU JUN 2015 as we cant live with these issues for another month or so. We have 2 WFE, 1 App and 1 SQL server farm and here are my questions:

1. What is the order of installation? a. Install SP2 -> WFE1, WFE2, APP -> RUN Config Wizard. b. Install Jun 2015 CU WFE1, WFE2, APP -> RUN config wizard.
2. Should we go with IIS under construction or leave as is? Or content database read only as per best practice during installation?
3. Should I run the config wizard twice OR all together I can run once after installing everything on all wfes and app servers?
4. Should I stop or redirect users to 'under construction' page during installation of SP2 & CU?
5. What if some users checked out files, configuration files during installation?
6. I noticed after SP2 installation, some of the unique security users and groups wipes out. What other known issues might occur? I am testing these patches on the staging server but we have installed everything on single server here and hence I am not very confident unless I test it on the exact production scenarios. Just checking any problem anticipated?
7. We have customized some of the pages, sites, lists and libraries using designer, visual studio and browser. Are there any possible chances of breaking? I don't see any issues in my staging though.

Many thanks