How to include CSS from a vendor directory?
It's probably best to copy it, yes. Drupal isn't set up to serve any assets from the vendor/ folder, and actively prevents it by default with an .htaccess file. Also, all assets are normally handled via "libraries", which are defined by a module and whose JS/CSS files must be in the module folder.

You could change the .htaccess and insert a direct style element with /vendor/.../xyz.css into the page, but at that point it's probably a lot cleaner and more secure to copy it.

If it changes often and you want to avoid manually copying/committing it every time, you might look at automating this with a build script (eg. with webpack).