I am looking for further information on protecting certain files so they cannot be edited unless the system is rebooted in Recovery mode. Is SIP the direction to go in? What are the steps to make an arbitrary file restricted?
You'll need to first disable SIP temporarily by booting up in Recovery mode (or any similar means).
Then either add the extended file attribute com.apple.rootless to the file, you want to protect - or add it to /System/Library/Security/rootless.conf.
After you reboot into ordinary macOS, the file should be restricted by SIP.