Basically what your options can be done in a multitude of ways. everything from having a separate download and overwriting the file (either the entire game or just the exe portion of the game). This can be preformed via updater to automate the process like Pieps suggested or downloaded manually by the player. Some games on steam have multiple copies of same game. Like basic edition, basic edition+DLC, gold edition (which was basically base+DLC+extras) they are for the most part standalone and separate from each other. Through steam it should be a simple check to see if they have x already purchased before they can purchase y. Some devs were smart and used the assets from the base game but used exe from the DLC version. (They required that both versions be installed, since DLC version only contained code) Not sure how steam handles updates so I can't really speculate to much. But I think they just have a simple upload of the entire game and just click publish and it pushes out updates overwriting everything and deleting and adding as necessary.
I would suggest going against a server verification system to unlock content. I'm not sure how steam works in the backend but having to design a system to check if you paid for content is more trouble then its worth. Your already making a commercial released game, that's hard enough without messing with netcode for verification. And not to mention that its feasible that if its already "on disc" that some people can find a way to unlock content. This assumes that you do on the verification once and store the variable hidden somewhere. Not doing that and doing the verification every time the launch your game would mean it more strain on server, and if it goes down then customers are going to get pissed they can't access content. And lets face it any average hacker, if given enough time, can easily overcome any protection you can come up with unless your into server side infrastructure, an IT security specialist, and a game developer. Bigger companies hire an army of guys that do nothing but this and they still get hackers they have to swat away.
3rd option I can think of would be to make your game modular. Basically you create the base game that houses all the games code. Then you create levels and asset bundles that downloaded separately and then all you have to do is find a way to references to the different bundles and which one to load for the next level. This actually makes modding/user created levels possible unfortunately this would drastically make the game more complicated. And possible mean you would have to program your own tools to create and "compile" levels (i say compile but basically all it would have to do is write a text file and populate it so it can be understood by the main game program)
Most of this isn't concrete and I have no idea how to steam implicates updates and DLC. I just thought I should add my two cents maybe it will help figure something out. Could someone that actually seen these steam tutorials give us some insight.