Discrete-Modulated (DM) Continuous-Variable Quantum Key Distribution (CV-QKD) protocols are a promising candidates for commercial implementations of quantum communication networks due to their experimental simplicity. While tight security analyses in the asymptotic limit exist, proofs in the finite-size regime are still subject to active research. We present a composable finite-size security proof against independently and identically distributed (i.i.d.) collective attacks for a general DM CV-QKD protocol. We introduce a new energy testing theorem to bound the dimension of Bob's system and rigorously prove composable security. We introduce and build up our security argument on so-called acceptance testing which, as we argue, is the proper notion for the statistical analysis in the finite-size regime and replaces the concept of parameter estimation for asymptotic security analyses. Finally, we extend and apply a numerical security proof technique to calculate tight lower bounds on the secure key rate. To demonstrate our method, we apply it to a four-state phase-shift keying protocol, both for untrusted, ideal and trusted non-ideal detectors.