Updating attack signatures (best practice)

no, you update all signatures at once, not per asm policy. the effect within an asm policy depends on the settings for that policy and as long as you use signature staging no signature will have a direct effect. on the other side some currently enforced signature will be taken out of enforcement and put into staging.

a lot depends on the backing you get from higher up. do they want top security then update en just enforce directly. might cause some extra false positives but will certainly give better protection. if they want to be more careful with unneeded block, update and watch the manual traffic learning to look at the hit signatures in staging. after a week enforce everything without hits and work on the ones with hits.