You can create a new unit that has the same name in /etc/systemd/system directory which contains only .include reference and your custom change.
That will ensure that your custom unit will inherit all "updates" security or otherwise made by the distribution relevant package maintainer to the relevant unit to his package while giving you the flexibility to have your own modifications.
For example let's say you want systemd to automatically restart the apache service should the apache daemon exits with an exit code not equaling 0,when it is terminated by a signal,when an operation times out or when the configured watchdog timeout is triggered.
You would create a new unit in the /etc/systemd/system directory called httpd.service and it would contain...