But to reiterate to make 100% sure we're on the same page:

The only way to upgrade software that has been installed from upstream (e.g. Moodle and most of the other web-facing software in LAMP based appliances) is to do it manually. We generally try to follow upstream's installation instructions so you should be able to manually update it fairly easily.

Doing a manual update like this won't affect any upgrade functionality. The auto (security) updates only apply to the Debian (and TurnKey) security repos (which covers the OS and main components such as Apache, MySQL, PHP, etc.

FWIW TKLBAM should also continue to work fine for you (should you choose to use it). TKLBAM will include the complete Moodle installation so your backup will include the version of Moodle which you are using. Although obviously as with any disaster recovery mechanism don't take my word for it. Make sure you test backups before you need them! I'd recommend that testing backup restores be a part of any complete disaster management regime.

On each appliance page (e.g. Moodle) you will find a link to the manifest. It lists all the software and versions that come from Debian and TurnKey repos (and will therefore get auto security updates).