I suspect that modifying Joomla's root composer.json file will come with Joomla 4. In the meantime, I think the best way to use composer packages is to include a composer.phar in a custom system plugin and then call the autoloader on the onAfterRoute event. Then it's globally available or if you want to only load the autoloader for 1 component for example you could pull the option value from the jinput and just wrap the require statement in an if. WARNING: check the Joomla library folder before including extra packages and don't install any packages that Joomla already ships with because Joomla's autoloader and your autoloader cannot co-ordinate different versions of packages and you may break everything!!! That being said that probably wont ever happen or cause any problems.
defined('_JEXEC') or die('Restricted access');
class plgSystemYayComposer extends JPlugin
require_once(JPATH_ROOT . '/plugins/system/yaycomposer/composer/vendor/autoload.php');
Obviously this technique is not applicable to development for distribution of components etc. You should probably also remove the phar file rather than leaving it in situ, and/or block all web access to the directory with an htaccess file but, y'know, I'm not your dad.