It depends. I know that's a cop-out, but it really does.
First, let me challenge you on marketing emails requiring re-approval: that's not the case. Data processed for the purposes of direct marketing needs a way for the user to be able to object to it, in which case you must stop, but that's not the same as required to opt-in again.
On to your question. IANAL(and you should consult one within your company) but a lot of your question to me seems to fall on what are the lawful basis you are using to process the data, what your privacy notice is, etc.
For example, if you are relying on "contract", and it is implied your customers are paying you to provide and notify them of security notices, then asking consent for this would be silly (but there are other rights you would have to be aware of)
In practice, as long as you are honestly and clearly telling users what you are doing with their data when you collect it (or soon after), giving them access when appropriate and holding it securely, you probably won't go far wrong.
Remember what the UK ico says:
The GDPR sets a high standard for consent. But you often won’t need
consent. If consent is difficult, look for a different lawful basis.
Consent means offering individuals real choice and control. Genuine
consent should put individuals in charge, build trust and engagement,
and enhance your reputation.
Edit: Additional Information on Consent
As mentioned, you may not need to get consent. This is all about the 'Lawful basis' you use for processing the data. Consent is only one of several available options, and should often be avoided where possible.
The UK ICO even has a couple of blog post about this:
Quoting from the second link:
Myth #9 We have to get fresh consent from all our customers to comply
with the GDPR.
You do not need to automatically refresh all existing consents in
preparation for the new law. But the GDPR sets the bar high for
consent, so it’s important to check your processes and records to be
sure existing consents meet the GDPR standard. If they do there is no
need to obtain fresh consent.
Where you have an existing relationship with customers who have
purchased goods or services from you it may not be necessary to obtain
And remember, if you use consent, that means you need to give the people option to withdraw it: Can you still operate an effective service for your customers if you cannot send service outage and maintenance announcement emails?
I cannot advise you on the your buisness without knowing a lot more about your processing, but it sounds to me like you might be relying on the 'Contract' basis more:
But be aware that you may need different basis for different things, for example, you may need to rely on consent for things like profiling done under your surveys.