Easiest is probably
ReiNX as it not only is free but bundles everything you need into one package.
In that case, you would use EmuNAND to run the latest firmware without breaking the firmware compatibility on SysNAND for untethered coldboot. And EmuNAND is now available for free CFW via Atmosphere albeit unstable and limited to hidden partition.
As for when you should dump your NAND, do it as soon as possible. While your chance of bricking is next to impossible while setting up CFW, you never know when you will run into issues.
Also I personally update without burning fuses all the time. What I do is download the system update in Hekate's stock mode (Hekate is another payload that also doubles as a bootloader aka tool for booting CFW), delete my Internet settings, make sure AutoRCM is enabled, then install the system update offline while running CFW. Normally AutoRCM is removed during a system update but if you are running the latest CFW, they prevent AutoRCM from being removed. I should also mention AutoRCM is the key to avoid burning fuses. The way fuses are burnt is that the console's bootloader checks the firmware with the fuse count. If they match, your console is allowed passage. If there are too few fuses burnt compared to the firmware, it will burn fuses so that they match then allow the Switch to boot. If too many fuses are burnt compared to the firmware, your console will not boot and the screen stays black which is a "soft brick" (soft because if you perform a manual shutdown, which is holding the Power button for 12 seconds, you can exit out of the brick). For reference, the list of fuses and their respective firmware versions can be found
here. Anyway I have been doing that method of updating without burning fuses for several months now and I have not been banned yet.