You're right to be paranoid about this - any app that stores third-party credentials is a potentially lucrative target for attackers.

Below are some thoughts on how to secure this information. But you absolutely should seek out security experts to advise you further on this and review your solutions.

Firstly, try to avoid storing user credentials at all!

Look for APIs from the third parties that give the information you need. These will enable you to create access tokens instead of using the user's credentials directly.

For example, here in the UK we have Open Banking. This is a standard for enabling apps to request access to your banking transaction history, make payments, etc. without storing the customer's credentials yourself.

If you do need to store the credentials themselves, storing them in a separate schema and wrapping access in a stored procedure is a good start.

Once you've done this there are more steps you can take to lock down access, including:

Create views

These expose the "safe" (non-sensitive) columns. Only grant other users privileges on the view, not the table itself:

create table credentials (
  ...
);

create or replace view credentials_public as 
  select non_sensitive_columns 
  from   credentials;
  
grant 
  select on credentials_public 
  to other_user;

Use row-level security (RLS) - Virtual Private Database/Real Application Security

Views are really a DIY RLS solution. With VPD etc. you can define policies on your tables over who can access what. The policies are transparent to the end-user, so you can hide columns or rows from all queries against the credentials table as needed.

Database-level protections like this are just the start though. You'll want to have "defence in depth" with checks throughout the tech stack to limit access and look for suspicious activity.

The technical brief Securing the Oracle Database A technical primer goes through the options Oracle provides to help you with this:

https://download.oracle.com/database/oracle-database-security-primer.pdf

Finally, once you have a working version of the application, ensure you organize penetration testing ("pen test") from a third party to search for and report on vulnerabilities in your application.