Hi, you onboarded the VMs to Arc, created the ESU license and assigned to those machines?
After this if everything is ok machine should start getting Critical updates (if present) from whatever method you are using, Sccm or Wsus
Ensure that network requirements are met: https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud