Currently, there's no way to use canaryAlarms without adding the stack composite alarm to the target function's deployment group. This default behaviour might not be desirable or expected by the users, and it's vaguely documented.
We'd like to add an option to avoid rolling back on a composite alarm, likely via an explicit alarms configuration, or a boolean flag configuration key.