Any system where VSE is already installed, if it does not have patch 2 yet then you only need the Patch 2 package.
For new installations of VSE, you can add the VSE 8.7 Patch 2 Repost package into your ePO repository (replacing the version that's there), and this way any new deployments of VSE will get this newer package.
The existing installations of VSE only need the patch package, and that you can check into the repository separately.
Enabling "Artemis" is done through the management console. The policies for On-Access Scanner and Email Scanner have an option "Network heuristic check for suspicious files" - this is the Artemis setting. For On-Demand Scans, the same option exists, and this can be configured when you create On-Demand scan tasks.