how to use composer when application and system directory are not in webroot?

I'm not a big fan of composer, nor am I especially well-versed in its use, but I have need of some code libraries/sdks that insist on using composer to install them.

In the interest of security, I have set up my CodeIgniter projects so that the application and system directories are NOT inside the webroot. I.e., my whole project is in:
/var/www/project

My web root is:
/var/www/project/html

My application and system directories are:
/var/www/project/application
/var/www/project/system

It is my understanding that setting codeigniter's composer_autoload configuration setting to TRUE will cause CodeIgniter to try and find Composer's autoload.php file in application/vendor. However, you can see that the default CodeIgniter directory structure has a composer.json file in the project's root.

What is the official word on using composer to install supporting code libraries (e.g., sendgrid/sendgrid, google/cloud-vision) to use in my codeigniter project? Do we install these in a vendor folder at the root of our project? Or do we install them in the application/vendor folder where CodeIgniter expects them to be fore composer_autload=TRUE? If we put the vendor folder inside the application folder, won't that mean that the composer.json, composer.lock, composer.phar files will also live in the application folder? Is this secure and/or desirable? Won't we then have a composer.json in the project root (the one linked above) and also a different one in the application folder? Seems a bit confusing.

And I'd point out that if we choose instead to install these packages in the vendor folder at the top level of our project (/var/www/project) in my case that CodeIgniter defines no constant for this directory. CI defines APPPATH, BASEPATH, FCPATH, and VIEWPATH but does not define any constant for the parent directory of the application and system folders. This doesn't present a huge obstacle if one chooses to eschew composer_autoload in favor of on-demand loading, but one must either require autoload.php by referring to some hard-wired path to this file (which breaks if you move your project), define a new constant for one's project root directory relative to some other directory constant, or do something like this:

Code:

require dirname(APPPATH) . "/vendor/autoload.php";

What is the best practice for use of third party libraries installed via composer? I'd love to know what is recommended and what the tradeoffs might be.