What is the correct way to exclude certain CSS files for anonymous, but include for authenticated users?
You should use hook_library_info_alter.

In which, you check is the user is logged in, or the logged in user roles, then simply unset the CSS files you don't want.