The 'distribution' can be either the release code name / alias (wheezy, jessie, stretch, sid) or the release class (oldstable, stable, testing, unstable) respectively. If you mean to be tracking a release class then use the class name, if you want to track a Debian point release, use the code name.
For example, if you have a system running Debian 8.3 "jessie" and don't want to upgrade when Debian stretch releases, use 'jessie' instead of 'stable' for the distribution. If you always want to help test the testing release, use 'testing'. If you are tracking stretch and want to stay with it from testing to end of life, use 'stretch'.
No. Not all updates are through your distro some updates come directly from the provider of applications (mostly 3rd party applications)
You can find out more here