WordPress with composer, how to handle updates?

Basically in “common” WordPress setup you have two things inside the folder that aren’t part of the core itself: content folder and wp-config.php configuration file.

So you are on completely right path:

1. You configure content folder to be elsewhere, outside of core folder
2. You place wp-config.php one directory level above the core folder (WP will look for it there if it’s not present in its root)

That way you have nothing in core folder left, which isn’t safe to delete and overwrite with new core version.