For just the security updates, e.g. Firefox, the necessary entry in '/opt/debextra' for, e.g. ub-dCore-trusty, should be of the form
http://<COUNTRY>.archive.ubuntu.com/ubuntu trusty-security {main,multiverse,restricted,universe}
where <COUNTRY> stands for a mirror (or can be left out.
These repos are so automatically enabled that I never even noticed them as separate entities. See also the thread on
Debian Jessie Security Updates.