I started writing this up as a question about putting ESXi at 6.5 u3 while vCenter Server remains at 6.5 u2, however it gave me a realization that has led to a follow-up question.
I then answered that question as I was writing it up, and I have another. *sigh*.
How do I (easily) have Patch Manager download the updates for an ESXi baseline to only include 6.5 u2 patches, and not u3 patches. When on 6.0, I recall applying some patches one day and was surprised to see I had gone from u1 to u2 by virtue of the patches I applied. The numbering/labeling schema of the ESXi updates don't easily/obviously (AFAI can tell) reference whether the patch is for a u2 or u3 release of 6.5.
Any recommendations on 'bypassing' the u3 updates for ESXi would be wonderful - my NSX is still on 6.3.x which isn't supported with 6.5 u3 vCenter/ESXi.