if I want to integrate a third party API to SuiteCommerce, do I just do it in the service file or do I need to call a Suitelet from there? What is your best practice on this?

You can probably just do it in the service file, and use elevated permissions if needed. If the functionality from the 3rd party api is something you would ever need to also use in the NS UI like when creating a SO or something then I would do it in a suitelet so you don't duplicate the logic. But with no context to what your doing it's kind of hard to say.