which certificate/identifiers/profilers should be used for python script to be distributed as a pyinstaller build/bundle outside the app store?
Outside the App Store you can use any ad-hoc or self signed certificate, but I recommend using an official developer account Developer ID for maxim ease of use.
Letting Apple notarize your app by signing your developer ID certificate, helps people trust your app.
Notarization is free for everyone except the submitter of the app. To notarize a specific item, You have to posess a current developer signing certificates. These can be obtained from an annual paid or free developer account (if you qualify for a free account).
The certificate type differs if you sign an installer vs signing an application.

https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087721


When code signing items like Mach-O files, disk images, bundles, apps, command line tools, photos, and so on, sign with a Developer ID Application certificate. Sign installer packages with a Developer ID Installer certificate.