My wheezy server has apt sources set as below
deb http://security.debian.org/ wheezy/updates main contrib non-free deb http://ftp.debian.org/debian/ wheezy-updates main contrib non-free
Are all security updates also available through regular wheezy-updates?
See my answer to What is the difference between the "jessie" and "jessie-updates" distributions in /etc/apt/sources.list? for details, but the short answer is no, not always: security fixes are made available as quickly as possible on security.debian.org, other (important) bug fixes go to wheezy-updates, and both eventually are merged into wheezy on point releases. (You can replace wheezy with jessie etc. for later releases, the process stays the same.)
Distribution
The 'distribution' can be either the release code name / alias (wheezy, jessie, stretch, sid) or the release class (oldstable, stable, testing, unstable) respectively. If you mean to be tracking a release class then use the class name, if you want to track a Debian point release, use the code name.
For example, if you have a system running Debian 8.3 "jessie" and don't want to upgrade when Debian stretch releases, use 'jessie' instead of 'stable' for the distribution. If you always want to help test the testing release, use 'testing'. If you are tracking stretch and want to stay with it from testing to end of life, use 'stretch'.
No. Not all updates are through your distro some updates come directly from the provider of applications (mostly 3rd party applications)
You can find out more here
