Is updating the composer.json file & consequently composer.lock in Drupal 8 considered a good practice or hacking the core? I have been working with another developers on a scaffolding tool for Drupal8 based on Symfony Console component.

The current setup process includes updating composer.json using composer CLI:

COMPOSER_BIN_DIR=bin php composer.phar require hechoendrupal/drupal-app-console:dev-master

Maybe writing to core/vendors is not the best practice any suggestions
Modifying anything in core is generally not recommended.
Unlike other projects that use composer, Drupal already has its composer packages included in core/vendor and you are not supposed to change them, nor the composer.json. Updates to Drupal 8 core would wipe your changes.

There is a module Composer manager that will open a second vendor directory in sites/sitename/vendor (I think). There is some discussion going on in the issue queue, e.g. Is it okay to have duplicates of symfony, guzzle, etc... in sites/all/vendors?. I imagine a future where sites/sitename/vendor could replace core/vendor. But we are not there yet.

I think you should participate in the composer vendor issue queue, this is all work in progress.

EDIT:
It should be mentioned that the way Drupal 8 is using Composer is not the way it is recommended. The recommended way is that the user should download Drupal and vendor packages via Composer. Instead, it is all pre-packaged. One reason for this is to support shared hosting where you don't have a commandline available, and just want a complete package to upload.