Your understanding of how Ghost updates your instance is spot on. Your assessment that making core changes can be difficult is exactly why it’s not suggested to make core changes, but you’re absolutely correct 
The problem with option 2 is that the git repository is inherently designed to be used for development, not production - for example, the admin client is built in real time, rather than using the bundled version included in the latest release. Your best bet is option 1. You can probably streamline applying your changes by using patches - this article seems to be a good starting point for that: