So, I want to find some solution where I can set only the composer.json file inside the plugin folder and after the plugin activation to pull and install the required SDK.
That’s not how it works. Composer is a CLI tool that’s meant to be ran via CLI, and wasn’t designed to run in a browser request context. If you achieve it, most PHP developers will consider it extreme bad practice.
You’re also very likely to swap your current problem for the problem of timeouts, if you can’t upload and unzip a single file into a folder in time, then running a CLI command to download multiple zips and write them to folders, and figure out dependencies won’t be much better.
If sounds like your actual problem is uploading large zips on the plugin page not working, why not ask about that?
So this is how you handle composer for plugin distribution:
If You’re Distributing The Plugin for Sale or to Customers
Run composer install then package up the result
If You’re Putting it In Version Control
Don’t run composer install, that happens during deployment/downloading
The same is true of npm or any other package management. You don’t run composer install or npm install in production, but rather you deploy the result to production.
A final note attempting to answer your actual problem:
You don’t need to install the dev dependencies to distribute the plugin. You’re likely installing everything from require-dev, and the package you want has PHPUnit and other QA tools listed as its dev dependencies, inflating the size.
Additionall, if you’re doing this for development, just install it directly on the filesystem using a local dev environment, and upload the final production build instead of a dev build.
Remove the minimum-stability: dev section or adjust your composer install command to only install things from the require.