Development – deployment environment
So the way I'd recommend doing it is that you use .gitignore to exclude your /vendor directory from the repo; a good starter .gitignore file can be found here: https://github.com/nystudio107/craft-scripts/blob/master/example.gitignore

Then you'll work on it in local dev, update Craft/plugins in local dev, and on deploy to production have it do composer install to update your /vendor dir to match what is is your composer.lock file.

The article Setting up a New Craft CMS 3 Project covers this in the DEPLOYING CRAFT CMS section.

You also might want to get a workflow set up for syncing the database and assets as per the Database &amp; Asset Syncing Between Environments in Craft CMS article.