Hi @arosboro,
Good to hear that you were able to get your contracts working how you wanted.
OpenZeppelin CLI uses the default account for the selected network, using the networks configured in network.js.
You can view the accounts by calling oz accounts and selecting the network.
If you are connecting to a public testnet via Infura (e.g. Deploy your contracts to a public network documentation) then OpenZeppelin CLI would use the default account (the first account generated from the mnemonic) unless from was specified (and the @truffle/hdwallet-provider was configured to expose multiple accounts, see Deploy your contracts to a public network documentation on how to do this).
Regards @openzeppelin/contracts-ethereum-package there is a discussion on Planning the demise of OpenZeppelin Contracts' evil twin, would appreciate any input you had.