One of the VM is pfSense which provides network to the Proxmox VE host. Is there a way to keep the VM running while updating the system? I currently don't have another router at hand.
While for me it smells like bad practice, yes, a running KVM process (= a VM) should keep running during execution of apt full-upgrade. Only after full-upgrade has finished you need to reboot.
What I always do (since the dark ages of unreliable connections) is to run "apt -d -y full-upgrade" in beforehand. This downloads all required packages without installing anything. Usually the "full-upgrade" can happen afterwards without any connectivity.
An additional safeguard for a risky system manipulation (which an upgrade from 8 to 9 may be) is to set a system wide checkpoint, at least if you are using ZFS: man zpool-checkpoint .
Another approach may be to have a local, caching proxy in the data-flow chain - possibly https://pom.proxmox.com/
I am in a similar situation. I have a spare router but I've not needed it. Having no PVE storage on the system disk makes for a simple image of the entire system disk (<5GB) for peace of mind. Then
apt update && apt dist-upgrade
Modify apt sources
apt update && apt dist-upgrade --download-only
Reboot with systemd.mask=pve-guests appended to default grub cmdline.