Will ‘practices’ api give us all practices or do we use ‘Authorized practices’ api to get practices that we are allowed to access?

First, you have to use the 'authorized_practices' API to get practices that you are allowed to access.

From 'authorized_practices' you will get a list of practices with office_id. Then you can use 'practices' API.