Postgres Repeatable Read vs Serializable
REPEATABLE READ is sufficient for your case. It will by definition prevent a “lost update”.
SERIALIZABLE is quite a bit more expensive than REPEATABLE READ, which is the “cheapest” of all isolation levels. More locks will be taken (SI locks that don't block anything, but can cause a transaction to abort), and these locks have to survive a commit. It is impossible to name a figure how much more expensive it will be; that depends on your workload.