apt-get update/upgrade list without changing anything

From the apt-get man page,

   -s, --simulate, --just-print, --dry-run, --recon, --no-act
       No action; perform a simulation of events that would occur
       but do not actually change the system. Configuration Item:
       APT::Get::Simulate.

       Simulation run as user will deactivate locking (Debug::NoLocking)
       automatic. Also a notice will be displayed indicating that this
       is only a simulation, if the option APT::Get::Show-User-Simulation-Note
       is set (Default: true). Neither NoLocking nor the notice will be
       triggered if run as root (root should know what he is doing without
       further warnings by apt-get).

       Simulate prints out a series of lines each one representing a
       dpkg operation, Configure (Conf), Remove (Remv), Unpack (Inst).
       Square brackets indicate broken packages and empty set of square
       brackets meaning breaks that are of no consequence (rare).

So just make sure you apt-get -s upgrade.

If you want to upgrade certain packages, just apt-get install <package name> and it will update it if it's already installed. It will however also have to update all the dependencies as well, and depending on what they are, that can cascade into a lot of updates.

If I'm behind on package updates, I'll do an apt-get install on some of the big ones (maybe php, apache2, etc.) so I can keep them contained and check any issues, and then apt-get upgrade after I'm done.

I use apt list --upgradable.
The next alternative is apt-get --simulate upgrade. (based on @EightBitTony)
Here are outputs from different options (hope it helps someone):

me@machine:~$ apt list --upgradable
    Listing... Done
    kubernetes-cni/kubernetes-xenial 0.7.5-00 amd64 [upgradable from: 0.6.0-00]
    N: There are 3 additional versions. Please use the '-a' switch to see them.

me@machine:~$ apt-get --simulate upgrade
    NOTE: This is only a simulation!
          apt-get needs root privileges for real execution.
          Keep also in mind that locking is deactivated,
          so don't depend on the relevance to the real current situation!
    Reading package lists... Done
    Building dependency tree
    Reading state information... Done
    Calculating upgrade... Done
    The following packages will be upgraded:
      kubernetes-cni
    1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
    Inst kubernetes-cni [0.6.0-00] (0.7.5-00 kubernetes-xenial:kubernetes-xenial [amd64])
    Conf kubernetes-cni (0.7.5-00 kubernetes-xenial:kubernetes-xenial [amd64])

me@machine:~$ apt-get -u upgrade --assume-no
    E: Could not open lock file /var/lib/dpkg/lock-frontend - open (13: Permission denied)
    E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), are you root?

me@machine:~$ sudo apt-get -u upgrade --assume-no
    Reading package lists... Done
    Building dependency tree
    Reading state information... Done
    Calculating upgrade... Done
    The following packages will be upgraded:
      kubernetes-cni
    1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
    Need to get 6,473 kB of archives.
    After this operation, 4,278 kB of additional disk space will be used.
    Do you want to continue? [Y/n] N
    Abort.

me@machine:~$ sudo apt-get -u -V upgrade
    Reading package lists... Done
    Building dependency tree
    Reading state information... Done
    Calculating upgrade... Done
    The following packages will be upgraded:
       kubernetes-cni (0.6.0-00 => 0.7.5-00)
    1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
    Need to get 6,473 kB of archives.
    After this operation, 4,278 kB of additional disk space will be used.
    Do you want to continue? [Y/n] n
    Abort.

To list packages to be upgraded with their versions:

$ sudo apt-get -u -V upgrade
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages have been kept back:
   mysql-client-5.5 (5.5.29-0ubuntu0.12.04.2 => 5.5.32-0ubuntu0.12.04.1)
   mysql-server-5.5 (5.5.29-0ubuntu0.12.04.2 => 5.5.32-0ubuntu0.12.04.1)
   mysql-server-core-5.5 (5.5.29-0ubuntu0.12.04.2 => 5.5.32-0ubuntu0.12.04.1)
0 upgraded, 0 newly installed, 0 to remove and 3 not upgraded.

Then, you can choose what to upgrade:

$ sudo apt-get --only-upgrade install mysql-client-5.5
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following package was automatically installed and is no longer required:
firefox-globalmenu
Use 'apt-get autoremove' to remove them.
The following extra packages will be installed:
libterm-readkey-perl
The following NEW packages will be installed:
libterm-readkey-perl
The following packages will be upgraded:
mysql-client-5.5
1 upgraded, 1 newly installed, 0 to remove and 2 not upgraded.
Need to get 8,123 kB of archives.
After this operation, 139 kB of additional disk space will be used.
Do you want to continue [Y/n]? Y
Get:1 http://us.archive.ubuntu.com/ubuntu/ precise/main libterm-readkey-perl i386 2.30-4build3 [28.4 kB]
Get:2 http://us.archive.ubuntu.com/ubuntu/ precise-updates/main mysql-client-5.5 i386 5.5.32-0ubuntu0.12.04.1 [8,094 kB]
...

If there are any old dependencies that are removed, you can then run apt-get autoremove, and as you can see, any new dependencies will be prompted to be installed. The --only-upgrade flag isn't necessary, but nice if you want to ensure that you don't accidentally install a new package instead of upgrading an existing one, i.e. you have one of those moments and accidentally type the wrong package:

$ sudo apt-get --only-upgrade install mysql-proxy
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Skipping mysql-proxy, it is not installed and only upgrades are requested.
The following package was automatically installed and is no longer required:
firefox-globalmenu
Use 'apt-get autoremove' to remove them.
0 upgraded, 0 newly installed, 0 to remove and 2 not upgraded.

Does it help you to issue apt-get -s upgrade which does only a simulation? And then you can update each wanted package with apt-get install <thepackage>.

If you want that interactive with a nice CLI GUI then use aptitude. If it’s not installed yet then install it with apt-get install aptitude.