composer ideally needs to be on both.
At any time, you should be able to rebuild the vendor folder using your composer.json file to state all the php packages required.
In development, after you run composer install, a composer.lock file is created that contains all the specific version of every package and their dependencies. This composer.lock file and the composer.json files are committed to your source code repository.
Then on production, you can clone the repo and run composer install. This will find your composer.lock file and pull down all the exact package versions as you used in development.