允许Apache在Web应用程序中运行composer update依赖项

In a LAMP application based on Symfony2, I need to provide a specific web service in admin panel to update "on-demand" specific dependencies managed by Composer ( ~like plugins update in WordPress admin panel).

Application are deployed on servers by real user (application files owner are not www-data).

I thought these solutions :

1. Apache user run directly Composer shell command (shell_exec, Symfony/Process):
   • composer.lock must be writeable for Apache user
   • $COMPOSER_HOME path must be defined and writable for Apache user
   • All concerned vendor dependency files must be writable for Apache user
   • Apache user should be able to use GIT client with SSH protocol
   • ... maybe other points i don't think
2. Apache user run Composer shell command as real user, using sudo
   • sudo must be configured to allow apache user to execute (only) composer as specified real user (Run a shell command as another user or change Apache's user?)
   • ...
3. Use third-party tool, cronjob or Event-driven I/O (ReactPHP ?)

I'm not sure if theses solutions are good, secure and simple to deploy.

What is the best way for you ? Any suggestions/ideas are welcome ! Thanks.