By default in Bedrock, the themes directory is completely independent of Composer. Anything in there should be included in your project’s repo and not managed by Composer (unless you actually wanted a parent theme that you were never going to modify locally).
Adding any plugins through Composer and running composer install or composer update won’t touch the themes directory.
And regarding Roots’ versions, whatever version you download and put into your themes dir will be whatever it stays at forever unless you manually apply updates since it’s not a Git sub repo or a Composer package.