Question: Is it possible to disable direct login for normal users (like `oracle`) in Linux but allow `scp` and `sftp` for that use?

Answer: 
Methods such as creating the file `/etc/nologin`, setting account login shells to `/bin/false` or `/sbin/nologin` effectively disable user accounts from logging into an interactive shell, but do not protect the system.

If you want to specifically restrict a user to using `scp` or `sftp` only, install a restricted shell that is designed to do exactly that. The `rssh` package is a restricted shell designed to work with OpenSSH. 

```
: rssh is a restricted shell for use with OpenSSH, allowing only scp
: and/or sftp. For example, if you have a server which you only want
: to allow users to copy files off of via scp, without providing shell
: access, you can use rssh to do that. It is a alternative to scponly.

```

You should seriously consider setting a `chroot` for the users logging in with the restricted `rssh` shell. 

Read and understand the security implications of restricting users in such a way. Start with the `man` pages for `rssh` and `rssh.conf`. You should also understand what a `chroot` [is and how it works](https://unix.stackexchange.com/questions/105/chroot-jail-what-is-it-and-how-do-i-use-it).
Yes, that is possible.

1. Set their login shell appropriately, e.g. by `chsh -s /bin/false ${user}`.
2. Tell `sshd` to use the internal `sftp-server`

```
Match User ${user}
  ForceCommand internal-sftp

```

`Match` blocks continue until the next `Match` block or the end of the file (indentation is just for humans), so it might be easiest to add this configuration at the end of the file.

(Substitute `${user}` with the desired username.)

Note that clients older than `ssh` version 9.0 can only use `sftp` with this configuration. From version 9.0 onwards `scp` works again because it has been changed to use `sftp` protocol internally.