Just one question, is there somewhere a guide (even a short note would be fine) to build a kernel - marked as stable - plus security fixes?

* get src.rpm of the latest stable kernel,
* unpack it "# rpm -ihv vzkernel-...src.rpm",
* get patches you want to apply (for example take from the devel email list or from vzkernel git tree)
You can also take a look at the list of issues listed at ReadyKernel site - just for the reference which are worth to apply.
* put additional patches to apply into ~/rpmbuild/SOURCES/ and edit ~/rpmbuild/SPEC/kernel.spec to apply new patches
(take a look how it's done for linux-kernel-test.patch kernel.spec, do it similarly)
* don't forget to add some suffix to "%define ovzver" in kernel.spec
* and finally compile the kernel, command example:
# cd ~/rpmbuild/SOURCES/ && rpmbuild -v --define "_sourcedir $PWD" -ba ../SPEC/kernel.spec

* clone vzkernel git tree
* checkout latest stable by tag
* apply new patches you want (may be just cherry-pick them from later branches)

* prepare a cumulative patch using a command for example:
# git diff rh7-3.10.0-862.14.4.el7 | filterdiff -p 1 --clean -x configs/\* -x config.OpenVZ\* | xz > ~/rpmbuild/SOURCES/patch-ovz.xz
(instead of "rh7-3.10.0-862.14.4.el7" you should use a tags for RHEL kernel which your stable kernel is based on)
For example for vzkernel-3.10.0-862.11.6.vz7.64.7.x86_64.rpm the RHEL tag is "rh7-3.10.0-862.11.6.vz7.64.7.el7"

* don't forget to add some suffix to "%define ovzver" in kernel.spec
* and finally compile the kernel, command example:
# cd ~/rpmbuild/SOURCES/ && rpmbuild -v --define "_sourcedir $PWD" -ba ../SPEC/kernel.spec