You don’t need to update the firmware, all firmware versions are compatible with the IXON Cloud 2.
Only people with the Manage devices permission are allowed to upgrade the firmware. You can determine yourself which roles will have that permission.
Yes, you can assign people that need to be able to manage devices to a role that has those permissions. And you can assign people that don’t to a role that doesn’t have those permissions.