What is the correct core update workflow? I want to use composer to manage Drupal 8 dependencies, but I'm not sure what is the right core update workflow.
At the moment I'm using drush to update core to latest beta release, but I also have some dependencies in my composer.json file, so after the update I'm using composer install to install all the contrib vendor dependencies.
It appears that running composer install overrides some files in the core directory, although I've just updated core to latest version.

I've also tried to manually edit the composer.json file and replace the "drupal/core" line with the specific beta release, e.g. "drupal/core": "~8.0-beta14",, but it still overrides files in the core directory.

What is the right workflow?
I presume that you are using drupal-composer/drupal-project as the basis for your project.  If not, take a look at that project, and compare it with yours.

Also, you said that you want to use composer to manage Drupal 8 dependencies, so I presume that you have selected your contrib modules via composer require drupal/devel rather than drush dl devel.

If you are doing all of these things, then you should use composer update to update Drupal core and all of your contrib modules.  As long as you retain your composer.lock file, composer install should not change the version of any of your dependencies.  You should not use drush pm-update at all.  It should not matter to you whether or not files in the core directory are updated or not, as this directory is managed by Composer.  You are better off not committing composer-managed directories to your repository, although you can if you wish.

Of course, you should run drush updatedb whenever composer update replaces Drupal core or any module.

To avoid getting development versions, set your minimum stability to 'beta' in your composer.json file using Composer stability flags.

If you are using drupal-composer/drupal-project to manage your site, then all of the root-level files such as README.txt, .htaccess and index.html become owned by your project. That means that you should check them in to your git repository; Composer will not update them, you must update them yourself when they change.  These files should change only rarely, but drupal-composer/drupal-project has a script to update these files.