[chuckadams]

They're all going to hit wordpress.org for plugins and themes. I would definitely stay away from Debian's packages, which are outdated the moment they're installed, and the setup looks painfully fiddly and manual anyway.

An alternative to wp.org's infrastructure would be the likes of https://roots.io/bedrock, which uses composer to install and update plugins and themes along with wordpress itself. The infrastructure it uses is called WordPress Packagist, which is run by outlandish.com using github as the distribution infrastructure. The whole thing is open source, so you could run your own wpackagist service if you like.

Using bedrock in a container, I upgrade the site by building and uploading a new container image. Anything goes wrong, I roll back to the previous image. Cattle, not pets.