The above text already explains the difference between those commands, but for fast readers:
composer install installs the vendor packages according to composer.lock (or creates composer.lock if not present),
composer update always regenerates composer.lock and installs the lastest versions of available packages based on composer.json
composer dump-autoload won’t download a thing. It just regenerates the list of all classes that need to be included in the project (autoload_classmap.php). Ideal for when you have a new class inside your project.
Ideally, you execute composer dump-autoload -o , for a faster load of your webpages. The only reason it is not default, is because it takes a bit longer to generate (but is only slightly noticable)