> In our scenario, we want to restrict access to the database using a password on the SYSDBA user.

Forget it. SYSDBA is (obviously) local database administrator. You
must not use this accout for your database.

> Can you give please me some advice?

Review your strategy of data protection.
For example - don't distribute database itself but let customers to
access data via the Net, keeping the database at your site under your
control.

SY, SD.