You could use Composer's autoloader without using the full Composer. eg.
<?php
include 'autoload.php';
$loader = new \Composer\Autoload\ClassLoader();
$loader->addPsr4('phpseclib\\', __DIR__ . '/path/to/phpseclib2.0');
$loader->register();
// insert your code here
Where autoload.php is this:
https://raw.githubusercontent.com/composer/composer/master/src/Composer/Autoload/ClassLoader.php
So at that point instead of having to code review the whole of Composer you just code review that one file.
You could also use the auto-loader by PHP-FIG:
https://github.com/php-fig/fig-standards/blob/master/accepted/PSR-4-autoloader-examples.md
<?php
include('autoloader.php');
$loader = new \Example\Psr4AutoloaderClass;
$loader->register();
$loader->addNamespace('phpseclib', __DIR__.'/phpseclib');
That said, I do think your companies policies are silly. If you're not going to trust Composer than why would you trust any third-party PHP library? So it's causing you problems with phpseclib today. What other libraries might you want to use in the future that this policy will also cause you problems?