Your DevOps people are right: You shouldn't need Composer to be run in production, on the production machine(s).
You have to think about a process to deploy your application. This usually means that you have a machine that is meant to do continuous integration, so every commit triggers the execution of the test suite and reports the results. Such a machine could be used to also do continuous deployment, for example to the staging machine.
What that means is that you have a machine that is able to put together all the different components that make up your application, and when all the parts have been gathered in that location, you move all the files over to the staging (and later production) system.
Because automation is king, you should create a script that does everything needed to get into that state of "completely assembled all needed files and done all necessary stuff". Why a script? Because doing these things likely will not only need one call to composer install --no-dev - for example, frontend components like Javascript are better managed using Bower or something that is NOT Composer. Composer is for managing PHP code.
When you have that deployment script, your DevOps guys will be happier: They can deploy the application by checking it out from the repository and then running one script. They do NOT need to install anything development related onto a production machine (note that every software that allows software development on a production machine is very useful for an attacker in case of security breaches).
All they need to do then is to copy files to make a new version live.