How to securely get data from customers?

I'm working on an app to help companies coordinate customer research. The users will primarily be Product Mangers at start-ups and SMBs.

Two requirements are:

• Users only need to know SQL (PMs should use this without help from engineers)
• The app needs to run queries periodically (so the customer list is up-to-date)

I'm wondering what the best solution is here. Two ideas I have are:

• Company shares their DB credentials with the app (pro: SQL only / con: security)
• Company creates an API endpoint for the app to access (pro: more secure / con: requires coding)

Any advice on the best solution here for my app? I imagine others have faced the same issue and it's not just me. Thanks!