Latest security updates with debootstrap?
From Debian Wiki, Debootstrap, https://wiki.debian.org/Debootstrap:
Debootstrap can only use one repository for its packages. If you need to merge packages from different repositories (the way apt does) to make a rootfs, or you need to automatically customise the rootfs, then use Multistrap, https://wiki.debian.org/Multistrap.