What files need to be moved for Craft3 plugins?
So you're really close; composer.json is a list of packages and their semvers that should be installed. composer.lock has a manifest of what is actually installed.

In order to deploy to production, you just need a step that executes composer install to install what is in the composer.lock file. Check out the Deploying Craft CMS section of this article for a more thorough run-through.