I initiated a deployment and set the restart to occur 5 minutes into the future. The restart didn't occur until all of the patches were processed, therefore this isn't a good method to ensure the deployment windows doesn't exceed your change window. Providing enough time for the scan and deployment to allow completion before 3AM is your only solution. Barring slow scan times (WAN links) or a large amount of patches, most scan/deployments are completed well before 3 hours. I would suggest testing.
We use the /norestart (or equivalent) switch for all patch installs. This means all patches are installed with no restart, the restart is controlled by the Deployment Template.