App Control Server does require the latest Cumulative Update (includes functional and security fixes), rather than the GDR (security fixes only).
While adjusting the Agent Enforcement Level is not required, it may be helpful as your Console will be unavailable for Approvals/adjustments while the upgrade is occurring.
If you are finding errors after the upgrade, please open a support ticket for assistance.