Hi Ken -
The direct answer is yes, you absolutely can use SM AutoUpdate for SMs that are set to Public.
It does depend on what type of server you specify in CNUT config as to whether setting to Public is required. If you have the server set to external TFTP server or CNUT HTTP Server, then all of the SMs must be publically accessible and able to reach the specified server (in the CNUT settings) via L3 topology.
In short - SM's set to Public will work for all types of server configurations while Local will only work when the CNUT server config is set to "The Access Point". If you set CNUT to use the Access Point as the file server, then it doesn't matter whether the SM is set to Public or Local, since the SM will communicate to the AP via the private RF LAN in order to retrieve its image.
It seems perhaps the manual may not be very clear here or just outright wrong. CNUT updating and autoupdate hasn't changed very much besides adding more external server options (HTTP/HTTPS), and the ability for 450/450i AP to hold all of the potential SM images for updating. I'm sure you'll recall that for FSK, CNUT had to rotate through the image types due to limited space on the FSK AP. For 450, this is no longer an issue which makes autoupdate go much quicker.
Hope this helps. If you have further questions, let me know.
Thanks
-Aaron