How to update drupal (with composer) and not update to the latest major drupal release
It depends on the version you specify in the composer.json file. You can specify broad versioning, or exact version, and composer will adhere to that.