I am using git to deploy my composer.lock to production. Contrib is not part of my git repo. Therefore, in production I then run composer install to add contrib to production.

What happens when I update a module in dev via composer update, then deploy the updated composer.lock to production and run composer install there? Will it update/replace the existing module code or what is the best practices to update a module in production without having to run the resource hungry composer update command in production?