To avoid overriding composer.json file you should update drupal/core using composer too.

https://www.drupal.org/docs/8/update/update-procedure-in-drupal-8

To update only drupal/core you will have something like

composer update drupal/core --with-dependencies

Which will only update the composer.json file, not overriding it.

To avoid overriding composer.json file you should update drupal/core using composer too.

https://www.drupal.org/docs/8/update/update-procedure-in-drupal-8

To update only drupal/core you will have something like

composer update drupal/core --with-dependencies

Which will only update the composer.json file, not overriding it.

[EDIT] Before you begin ( from documentation )

1. Always take a backup of your files and db before updating.
2. If you're using composer and version control, also commit and push composer.json and composer.lock. Use mysqldump to backup your database. Modules such as Backup and Migrate are also available.
3. Alternatively, you can create a .tar.gz of files and the database with drush archive-dump (however this is a legacy command, slated for removal in Drush 9, which only covers files under /web).
4. Read the core release notes and, as a precaution, check the project page for each contributed module, theme or plugin: some may need updating to work with a new "minor" version (e.g. 8.3) of core. Patch releases (e.g. 8.3.1) shouldn't require this, but it's advisable to test in a development environment first.
5. Activate maintenance mode when updating production servers.