Update core keeping other composer packages
If you have a composer based project, you probably should use composer to update it.  E.g.:

composer update drupal/core --with-dependencies

Make sure to keep the composer.json, composer.lock, and docroot/vendor/composer/installed.json files in your repository.

Note:  It's best to go 'all-in' with composer and use it to add and maintain modules as well as core. E.g.:

Add new module:   composer require drupal/module

Update module:  composer update drupal/module --with-dependencies

To manage patches, see the cweagans/composer-patches project.

You can also include various 3rd party libraries (e.g. chosen, colorbox, and the like) using your composer.json file.