What is the correct core update workflow?
I presume that you are using drupal-composer/drupal-project as the basis for your project.  If not, take a look at that project, and compare it with yours.

Also, you said that you want to use composer to manage Drupal 8 dependencies, so I presume that you have selected your contrib modules via composer require drupal/devel rather than drush dl devel.

If you are doing all of these things, then you should use composer update to update Drupal core and all of your contrib modules.  As long as you retain your composer.lock file, composer install should not change the version of any of your dependencies.  You should not use drush pm-update at all.  It should not matter to you whether or not files in the core directory are updated or not, as this directory is managed by Composer.  You are better off not committing composer-managed directories to your repository, although you can if you wish.

Of course, you should run drush updatedb whenever composer update replaces Drupal core or any module.

To avoid getting development versions, set your minimum stability to 'beta' in your composer.json file using Composer stability flags.

If you are using drupal-composer/drupal-project to manage your site, then all of the root-level files such as README.txt, .htaccess and index.html become owned by your project. That means that you should check them in to your git repository; Composer will not update them, you must update them yourself when they change.  These files should change only rarely, but drupal-composer/drupal-project has a script to update these files.