the short version: draw a number between 1 and 21 and update this unit. Loop until all are done.
the long version: FortiOS 6.2 and 6.4 are compatible, especially in respect to IPsec VPN. You don't have to fear that the connection will fail just because both units are on different OS versions. Different situation if you're looking at FortiGates and FortiAnalyzer, or Gates and FortiManager.
My experience with v6.2 and v6.4 is that the latter is leaner and smoother, so to say. So, I would upgrade the central hub first, just for stability. As you like...
Situation like this, I tend to upgrade one remote first then wait at least a couple of days to make sure 1) 6.4.x doesn't break anything at the remote environment including memory/CPU usage for daemon processes, and 2) VPN between 6.2.x and 6.4.x works as expected.
Then either work on the head office next or upgrade all other remote locations, which I would be comfortable because I already tested at one location. The head office upgrade is the most important so maybe leave it for the last.