If you want to figure out which method is right for you - WUfB or WSUS, see my article here
https://www.ajtek.ca/blog/wufb-or-wsus-which-is-better/
If you want to learn how to manage WSUS properly where it takes 5-15 minutes a month to approve the needed updates to both a testing group and then also into production, follow through my 8 part blog series on How to Install, Manage, and Maintain WSUS.
https://www.ajtek.ca/wsus/how-to-setup-manage-and-maintain-wsus-part-1-choosing-your-server-os/
If you want to configure WUfB
https://www.ajtek.ca/wsus/windows-update-for-business-why-should-i-choose-it/
(Thanks for the reminder, I should add a new article with all the new settings for WUfB, especially with the new scan source policies).
If you want to reset the WSUS GPO policies for testing - https://www.ajtek.ca/wsus/reset-windows-update-gpo-settings/
Now, getting to your initial issue - your systems are having failed updates. Failed updates on installation will not be fixed by pointing to WUfB if the issues related to the failed updates are due to corruption on the client. If it's caused by missing updates (because you don't have the correct products selected in WSUS), then it would pick up the new updates and install them properly first, thereby allowing your failed updates to install successfully afterwards.
Always first try and let Windows Self-Heal – run:
sfc /scannow
DISM.exe /online /cleanup-image /restorehealth
and in some cases where DISM fails, you may need the current version media and specify it:
DISM.exe /Online /Cleanup-Image /RestoreHealth /Source:wim:E:\Sources\Install.wim:1 /limitaccess