If you want automatic failover, yes - you need somewhere to add a third "something". That does not have to be a full-blown Redis node, it could simply be somewhere to run a 3rd sentinel process (arbitrator). This third "thing" could be an ultra small VM or server (hmm - wonder if you could run a 3rd sentinel on a Raspberry Pi :), I dunno, interesting thought... )
Essentially all the automatic failover mechanisms in Redis (Sentinel or Cluster) require quorum for decision making. With only 2 servers, there is no ability for quorum when one is down.
Now, if you don't want automatic failover, you can use 2 nodes. One is always master, one is replica. When you perform upgrades, you upgrade the replica node first, make sure all is well with your upgraded application, perform a manual failover (gracefully stop redis master, convert replica to master, and set old-master as replica of new). Then perform your upgrade of the second node (now a replica). IT can be done fairly easily, just requiring manual management of the process.