How to declare core requirements in composer.json?
On further experimentation, it appears that it is unnecessary to add this to the composer.json file. It is enough to add drupal:system (&gt;=8.3) to the info.yml requirements. This seems to be automatically interpreted by the drupal.org package repository.

Even when the composer.json file does not specify any dependencies, composer show drupal/MODULE will show that it requires ^8.3, and it will be impossible to install the composer package on an 8.2 site.