According to the wiki, there is some tolerance in the accepted timestamp for a new block:

A timestamp is accepted as valid if it is greater than the median timestamp of previous 11 blocks, and less than the network-adjusted time + 2 hours. "Network-adjusted time" is the median of the timestamps returned by all nodes connected to you.

The reason, as explained in an answer to a related question, is that "without a central authority, it's impossible to know for sure what the current time is" (in the sense that, while there might be standards that set the "correct time", you can't prove that an operation that happened in a computer somewhere in the world actually happened the time it says it did).

So, answering your doubts:

• Who updates the timestamps?

  The miner that produced the block assigns the timestamp, and the other peers in the network endorse it.

• Are the timestamps used to verify transactions in chronological order?

  What matters is the order of blocks in the blockchain, not the order of the timestamps (since to produce a block you need a previous block "done", it follows that the transactions in that block happened after the transactions of the previous one).

• If a block with a certain timestamp is added to the blockchain, will any block with an earlier timestamp be rejected?

  Only if it falls outside the margin of tolerance mentioned above.

• How is the timestamp used by the protocol?

  I'm not sure of all the reasons it exists, but you can start by looking at this and this questions. My understanding is that it's unfeasible to know exactly when a transaction happened, but you still need a rough knowledge of the time at the very least, for several reasons.