if your WSUS server is set to detect only critical updates, then you go through all 300 odd critical and recommended updates, approve each one you want to install. WSUS gives you the ability to group computers and servers into groups, or keep certain computers seperate such as in the case of machines that run legacy programs that some updates, hotfixes or service packs break or there are some applications that require a hotfix to be installed to run. You can approve only those you need.
If you only want XP SP2 to install on clients, then that is the only one you approve.
Initially, setting up WSUS can be daunting as you get "everything" and have to determine the patch level of each machine, weed through those you need and do not need, approve the ones that need installing and delete those you don't need. Once you've got it all configured, WSUS really works well in keeping all machines patched up.