When you run composer update, the OS will look into the configured paths and try to locate an executable file with that name.
When running php composer update, the composer string is treated as a parameter to PHP, which is not searched in any paths. You have to provide the full path in order to run it.
Running which composer will let you know where to find the composer executable, and then you simply use the full path in the PHP command:
which composer
/usr/local/bin/composer
php -d memory_limit=-1 /usr/local/bin/composer update
The -1 for unlimited memory
