How do I update modules with security release only using composer? On a Drupal 8 site, using the drupal-composer/drupal-project template, how would I go about updating only those modules which have a security release?

Our policy is to not update any module in our monthly maintenance routine unless it has a security update.

Ideally I'd like to find a solution which could be automated.
(I am using Drupal 7 modules as example, but just because there are more examples of security updates for Drupal 7 modules.)

Without custom coding, it's not possible. Drupal.org doesn't use a different name schema for security updates. From the version number you cannot know that version 7.x-3.14 of the Views module was a security update, while version 7.x-3.13 was not a security update.

That information is kept in https://updates.drupal.org/release-history/views/7.x, for the Drupal 7 version of the Views module, or in general in https://updates.drupal.org/release-history/&lt;project short name&gt;/&lt;Drupal version&gt;.
In the list of terms associated with a release, a Release type term whose value is Security update means the release is a security update.

&lt;release&gt;
  &lt;name&gt;views 7.x-3.14&lt;/name&gt;
  &lt;version&gt;7.x-3.14&lt;/version&gt;
  &lt;tag&gt;7.x-3.14&lt;/tag&gt;
  &lt;version_major&gt;3&lt;/version_major&gt;
  &lt;version_patch&gt;14&lt;/version_patch&gt;
  &lt;status&gt;published&lt;/status&gt;
  &lt;release_link&gt;
    https://www.drupal.org/project/views/releases/7.x-3.14
  &lt;/release_link&gt;
  &lt;download_link&gt;
    https://ftp.drupal.org/files/projects/views-7.x-3.14.tar.gz
  &lt;/download_link&gt;
  &lt;date&gt;1466019539&lt;/date&gt;
  &lt;mdhash&gt;168bb684c8f34297be94b03c797841e5&lt;/mdhash&gt;
  &lt;filesize&gt;1656594&lt;/filesize&gt;
  &lt;files&gt;...&lt;/files&gt;
  &lt;terms&gt;
    &lt;term&gt;
      &lt;name&gt;Release type&lt;/name&gt;
      &lt;value&gt;Security update&lt;/value&gt;
    &lt;/term&gt;
    &lt;term&gt;
      &lt;name&gt;Release type&lt;/name&gt;
      &lt;value&gt;Bug fixes&lt;/value&gt;
    &lt;/term&gt;
  &lt;/terms&gt;
&lt;/release&gt; 


The classes under the \Drupal\update namespace can help in writing the required code. UpdateProcessor::parseXml() is the method used to parse the XML data for a single project, but you would probably need to access one of the services Drupal implements.