Am I correct that only ARP request and ARP reply messages will update the Cisco IOS ARP cache?
I wouldn't say that ARP Requests / Replys are the only way an address makes it into the FIB, but it is certainly the most predominant. Gratutious ARP has been mentioned a few times, and with good reason. It doesn't follow the standard ARP Request/Reply procedures, but certainly accomplishes the same goal – populating the FIB with a relevant entry.
Don’t forget about manual intervention. Another way of populating the FIB is by manually setting a static address on the interface or having one automatically stick with port-security.