To avoid overriding composer.json file you should update drupal/core using composer too.
To update only drupal/core you will have something like
composer update drupal/core --with-dependencies
Which will only update the composer.json file, not overriding it.
[EDIT] Before you begin ( from documentation )
- Always take a backup of your files and db before updating.
- If you're using composer and version control, also commit and push composer.json and composer.lock. Use mysqldump to backup your database. Modules such as Backup and Migrate are also available.
- Alternatively, you can create a .tar.gz of files and the database with drush archive-dump (however this is a legacy command, slated for removal in Drush 9, which only covers files under /web).
- Read the core release notes and, as a precaution, check the project page for each contributed module, theme or plugin: some may need updating to work with a new "minor" version (e.g. 8.3) of core. Patch releases (e.g. 8.3.1) shouldn't require this, but it's advisable to test in a development environment first.
- Activate maintenance mode when updating production servers.