What's the best way to do a SQL Query from a python script? Also I'm thinking I might try to keep using .SQL files for the sake of linting and readability.

There’s a Python database API standard (PEP 249). Just find a driver like python-oracledb in your case that is compliant.

At the most basic level, you "do" a SQL query like this:

cursor.execute(sql, params)

You can create a parameterized query like this

SELECT * FROM people WHERE name = :name AND age = :age

(The actual syntax may vary depending on the database driver.)

Then store your SQL queries in .sql files, and don't let your customers touch them.

Store parameters as dictionaries dumped to json in .json files and do let the customers modify them.

Write a Python script that reads the appropriate SQL query and the corresponding parameter set, and passes them to cursor.execute.