I know they both put the gems in your app in different locations but it seems as if bundle install --deployment does a more thorough job. Can I just add the vendor/bundle directory it creates to version control and be done?
Have a look at the description of the two on Bundler's site.
Running bundle install --deployment is to be run in the production environment, but will grab the gems from rubygems when run. Read more here under the 'Deploying Your Application' heading for the purpose of the --deployment flag.
bundle package is similar to the old rake rails:gems:freeze command from Rails 2.3. It grabs the gems and packages them in vendor/cache. From the bundler site here:
You can use this to avoid a dependency on rubygems.org at deploy time, or if you have private gems that are not in a public repository