Duct9143 As you said, its not recommanded but if you want to try it anyways here you go:
Is it best practice to give it full file access, rather than storage scopes for certain folders only?
Yes.
Would it make sense to give it network access only for updating the databases every so often, for example, and then disable that permission again?
No. Give all the time, because an app could just collect data while offline and send it off when it has network again. It either has network or not from the start.
In the menu, does it make sense to also include /system and external storage? Does this even work without root?
Im not sure if it still works, it used to without root. It would not hurt to have it enabled either way.