How do I keep multiple sites in sync using drupal-composer/drupal-project
There are a number of different options that are all viable here; this is what I would suggest:


On your dev site, run composer update with options to suit what you want to update.
Run drush updb on your dev site.
Test thoroughly; then commit composer.json and composer.lock and push to your repository.
On your test site, pull your repository and run composer install.  This will put all of your dependencies into the exact same state they were in on your dev site, so you will get exactly what you tested.
Run drush updb on your test site.
Test thoroughly again.
When you are ready to deploy to your live site, put it in maitenance mode and use a file copy program (e.g. rsync) to move the exact files from the test site to live. Alternately, you can use composer install again.
Run drush updb on your live site.
Confirm that all is okay and take your site out of maintenance mode.