When you run
composer update, the OS will look into the configured paths and try to locate an executable file with that name.
php composer update, the
composer string is treated as a parameter to PHP, which is not searched in any paths. You have to provide the full path in order to run it.
which composer will let you know where to find the composer executable, and then you simply use the full path in the PHP command:
which composer /usr/local/bin/composer php -d memory_limit=-1 /usr/local/bin/composer update
The -1 for unlimited memory