Steps to update vendor files after pulling changed composer.lock file
In symfony I would delete vendor dir and run composer install. But in
  drupal not all files are in vendor dir.
  
  What is the best workflow in this case? Should I manually delete old
  vendor files (what dirs exactly?)


See .gitignore in your project dir:

# Ignore directories generated by Composer
/drush/contrib/
/vendor/
/web/core/
/web/modules/contrib/
/web/themes/contrib/
/web/profiles/contrib/
/web/libraries/


In case you want to do a fresh start with composer install you can delete all files with:

git clean -fdx .


See https://www.git-scm.com/docs/git-clean/1.7.0