Is there a way to tell composer about manually updated modules?
Yes, in the sense if you want to hack composer.lock you can make Composer think it got updates it never downloaded.

That requires you to know what composer.lock properties have changed (like content-hash &amp; packages[*]) and apply them manually to the file. 

That said, doing this is breaking the entire purpose of Composer (composer.json represents a manifest of what you need &amp; composer.lock represents a manifest of what Composer retrieved); you
 run the risk of breaking of what composer.lock should do (i.e. composer install on any machine will retrieve the exact same files as when you made your last updates); so you 
 should really think about the impacts on other environments/hosts that use your composer.* files.

If you're committing to a Composer-driven process, it's better to troubleshoot why your dependencies aren't updating as other commentators have suggested (e.g. too broad versioning in composer.json, auto-dropped changes from a non-interactive run)