Yes, script parameters are the right way; when a bundle is installed/updated, you have the option of overwriting deployments, which you would disable when installing for a client