Dread is a strictly narrative game, and a particularly nasty one at that. Not only are you the sole arbiter of when and how badly the characters are injured, you are actively encouraged to do so to add tension to the game.
As the GM, it is within your power to do anything to a PC's character, so long as it doesn't remove that character from the game. If a player tells you they jump off a landing (and didn't take an optional pull to protect themselves), you are within your right to say they've landed badly and sprained their ankle.
Dread does not have a special-purpose combat system. It handles combat the same way that it handles everything else: The GM presents a scenario, the players react, and the GM narrates the outcome. All the standard rules of pulling apply in combat: Players can make voluntary pulls to protect themselves, complex or difficult actions can be broken up into multiple pulls, and so on.
Here are a few tips I've picked up for Dread combat:
Be aggressive. Don't start combat by saying they see a bad guy... Start it by having the bad guy leap out of the shadows, knock them to the ground, and then start chewing on their nearest limb. Then ask them what they want to do.
That lacerated forearm might never have any impact on the game. Or it might justify a pull (or additional pull) later on. Either way it's something for the players to chew on.
Naturally, if the players don't want to be ambushed, they can make elective pulls. Which is great, because later on it will get the players thinking about the structure of the tower, and (later in the game) whether they really want to take things slow or risk an ambush.
Don't forget to ask for extra pulls for difficult tasks. It is well within the players rights to ask to make an extremely precise shot (a bullet directly to the left pupil, or the like). It is also well within your rights to ask the players to pull several blocks to make that happen.
Keep all the players involved. Unlike D&D, you're better off spreading attacks throughout the party rather than focus-firing a single character. Once a monster has spent some time mauling the first player, it can wheel around and jump to someone who's been trying to keep their head down.
Answers to your specific questions:
Do I create a combat order?
No. Combat should flow fluidly, based on the actions characters take. You can use a rough order to make sure you aren't leaving anyone out, but it should still flex to handle the narrative.
Do I pull for NPCs?
Absolutely not. The GM should never touch the tower. If the players can try to game the GM into pulling, it undermines the tension inherent to the tower.
How can I justify giving the characters injuries?
Your job as a Dread GM is to arbitrate the effects of the story. If players aren't making voluntary pulls, Dread assumes they are at the GM's mercy.
How do I tell when it's time for an NPC to die during combat?
When the player characters have done enough to it that you feel it's appropriate for it to be defeated. If it's one mook among an army (like the aliens in Beneath a Steel Sky), it might go down with only a couple of pulls. If it's a lone villain (like the wolf in Beneath a Full Moon) it might require some clever thinking and many pulls.
Is the idea to keep away from sustained combat?
You will rarely have combats as long as, say, a typical D&D combat (everyone at the table taking two to three major actions). The system is fine with longer fights, they just tend to be unnecessary. You shouldn't feel obligated to stretch a fight, but you can if it feel appropriate.