Composer, git and update core and modules
Is it correct that "composer install" does install the versions as defined in composer.lock which gets created after "composer install" is run the first time?


The composer.json file describes which versions can be installed, while the composer.lock module contains the version of the installed libraries.

For example, the composer.json file could contain the following, which would say that is only acceptable to install any version that is greater or equal to 1.0 but lower than 1.1.

"require": {
    "monolog/monolog": "1.0.*"
}


The composer.lock file could contain a "monolog/monolog": "1.0.2" line, since that is the higher version available of the Monolog library that respect the restrictions of the composer.json file.

So, simplifying:


The composer.json file is used from composer install
Both the composer.json and the composer.lock files are used from composer update



  When I start composer install locally earlier as my colleague he/she might get a newer version of Drupal which may lead to different behaviors of our working copies (although it should not with regards to versioning rules - I know).


Yes, that can happen, but it is not a problem, since you just need to run composer update to get the same versions your colleague has. That is, if both of you have the same composer.json file, and neither of you installed other libraries that could cause any conflict.