Add Tor's repo in your system: https://support.torproject.org/apt/tor-deb-repo/
Then install unattended-upgrades too:
https://wiki.debian.org/UnattendedUpgrades
Unattended-Upgrade::Origins-Pattern { "origin=*"; };
This way (by including all origins) you basically keep all your packages upgraded.
Regarding CPU, you can give a try to cpulimit. I've never tested it with tor though: