Hi,
I think that your assumption sounds right. We usually first clone our whole installation to a test server and run the upgrade there. Usually we have to fix some data in the database during these test runs because we have a lot of journals with a lot of old content and some data seems to get corrupted over time due to various reasons. When we have enough knowledge of the upgrade, we close down our production server (change the apache settings to serve another directory with a maintenance message) and then run the command line based upgrade. As you said, if you let people access your production server while upgrading it, it could lead to some problems.
I do not think that you need to run the web based upgrade after you have done it from the command line.
I suggest that you do another upgrade attempt and this time add the copy of the public folder there as well.
In config.inc.php make sure that you change the database name to the copy, that the files directory setting is pointing to the copy of files directory and that your base_url setting is pointing to the testfolder you are using.
Make sure that the files directory, cache directory and the public directory are readable and writable. If you run the upgrade with root permissions, it should work anyway, but after the upgrade the folders have to be readable and writable also for the apache user (what this means depends on your server, see How should file permissions be set?)
After the upgrade make sure you change installed to On.