as for the question of the version to give for 'composer require typo3/cms':
- Leaving the version blank will always give you the latest stable version. At the time of this writing this would be 8.7.6, and would end up in composer.json as ^8.7.
- Providing a major version will give you the latest stable version of this branch, and also make for ^8.7.
- Providing a minimum version like ^8.7 (as Peter mentioned) will of course give you that as well, but it is not necessary.
Conclusion: Providing a major version is completely fine and sufficient for retrieving a dependency. It will also kept to the latest version as long as there will be some released. You must not worry on your own, and also you must not know what the current minor version of your required software is. Composer knows, that should fit the bill just fine.