One alternative might be to use composer for dev, release build and all other environments that are under your control.
Then on the live systems you have a complete set of files/code to deploy.

I’ve been working with this and it is a great compromise. It allows to use composer the way it is meant to and still you end up with a release (archive, rpm, etc) that has no further external dependencies.