How to recreate Oracle db from .ora and .dbf

Toad cannot directly read Oracle data files, no. You would need to recover the database on a local server. Once you do that, you could connect to Oracle database on the local server from Toad and run whatever queries you'd like.

Assuming that what you've been given is a consistent cold backup of your database, you'd need, at a minimum, exactly the same version of Oracle (patchsets included) on exactly the same operating system that the third party vendor uses. Assuming that the vendor is vaguely competent about applying patches, that will likely require that you have a My Oracle Support account which would require that your organization has appropriate Oracle licenses. How you do that will depend on the operating system your Oracle server will be using.

Since it sounds like you are not a DBA and you're not particularly familiar with Oracle, assuming there is a reason that you can't simply access the existing database to run whatever queries you need to run, I would tend to suspect that you would be much better off requesting an export of the database (or potentially the tables you're interested in if you really care about a subset of the data) rather than a backup. Toad can't read an export directly either but it is a lot easier to import and export file into a database you create on your local server without worrying about matching the version and operating system that the vendor uses or going through the effort of doing a proper database restore.

In the simplest case, when you restore a database, you tell RMAN to recover it to the most recent point in time by applying all the redo (archived and online) that is available. That will re-apply any statements that were executed during normal database operations including things like dropping tables and deleting data. If you want to restore a database to a point in time before something bad happened, you'd need to do a point-in-time recovery with something like

RUN
{ 
    SET UNTIL SCN 1000;    
  # Alternatives:
  # SET UNTIL TIME 'Nov 15 2004 09:00:00';
  # SET UNTIL SEQUENCE 9923;  
  RESTORE DATABASE;
  RECOVER DATABASE;
}

Normally, you'd specify an UNTIL TIME or UNTIL SCN that was just before the first erroneous command.

In general, though, you would try to avoid using RMAN to recover from human errors. Generally, doing a full database restore is a last resort and generally there are other transactions going on that you don't want to lose. If a DBA inadvertently drops a table, for example, you don't want to restore the database and lose all the transactions that other people had made after the table was dropped. You would generally do a FLASHBACK DROP

FLASHBACK TABLE table_I_should_not_have_dropped
       TO BEFORE DROP

to restore the table from the recycle bin (which is almost instantaneous). If you deleted