I would keep the custom ribbon and the vba scripts in the same template. Keeping them separated doesn't offer any benefits but does give you another point of failure.

The execution of the update script (in whatever form you use) should happen at startup to give you the best chance of Word being closed (the copy will fail if Word is open when writing updates to the Word Startup folder). I used a vbs script when I manually did this but our IT group replicated that functionality via their group policies and scripts.

Security profiles will block scripts AND dotm files from working when sourced from an intranet so your system will need to work from a shared network drive rather than an intranet.

Are you also distributing document templates? If your startup templates include styles then they don't become available to the users documents via that path.

__________________
Andrew Lockton
Chrysalis Design, Melbourne Australia