1. Does all user need to include this registry key for MBSA to perform correctly?
Even if the registry is to be set, it is to be done once per system. The registry which is to be set will be applicable system wide.
Now coming to the point of setting up the registry; YES, you'd have to set up the registry either manually, or using Antivirus (if you've one which is compatible and supports this), or by using Group Policy in AD.
2. Is there an official bulletin for MBSA stating point 1?
Yes, in the Microsoft's Advisory chapter "Important: Windows security updates released January 3, 2018, and antivirus software", they have explicitly mentioned this line:
Windows Defender Antivirus, System Center Endpoint Protection, and
Microsoft Security Essentials are compatible with the January 2018
security updates and have set the required registry key.
Customers without Antivirus
In cases where customers can’t install or run antivirus software,
Microsoft recommends manually setting the registry key as described
below in order to receive the January 2018 security updates.
Setting the Registry Key
Note: Customers will not receive the January 2018 security updates (or any subsequent security updates) and will not be protected from
security vulnerabilities unless their antivirus software vendor sets
the following registry key:
As you can see, there is no inclusion/mention of MBSA in the article, which means that someone has to do the setting of the registry manually to get the January, 2018 Windows updates, given that the prerequisites are set.