How can I upgrade ONLY Drupal core with composer?
I do two things.


I use webflo/drupal-core-strict in my composer.json to make sure the same tested core dependencies are the ones used in my project.
I pin both drupal/core and webflo/drupal-core-strict to an exact Drupal version so I can regression test and know exactly what I am deploying.


So, my projects looks like

"require": {
    "drupal/core": "8.3.6",
    "webflo/drupal-core-strict": "8.3.6",
    "composer/installers": "^1.2",
    "drupal-composer/drupal-scaffold": "^2.2",
    "cweagans/composer-patches": "~1.0",
    "drush/drush": "~8.0",
    "drupal/console": "~1.0",
},


And where there is a new core version, I composer update drupal/core webflo/drupal-core-strict and then double check the lockfile.