I agree with @fhusain ... you can't embed JS inside of documents to track the clicks... the only solution is to use a proper campaign... and that is a web standard that even Google uses.... look at Google Ads, they add ?gclid=232323235 and other params onto their ads for tracking purposes.... So Google definitely wouldn't penalize you for having your own tracking campaigns on your URLs....
This is a standard for both external campaigns and internal ones (these are usually kept separate so that there's not cross over corruption between your two standards - i.e. User comes from paid search with external campaign, then clicks on an internal promo banner.. storing these individually allows you to look at both on your conversion event).
Query String Parameters are a standard part of web URLs... look at Search Results... the keyword, filters, pagination, etc are all passed as parameters.... Google doesn't penalize those pages (of which almost every site in the world has, and all search engines, including Google use).
I am not sure what your web team was thinking when they flagged this as a possible concern... And for the record, I come from a web development background, I work in our digital development department, and not only am I in charge of the Analytics, I am also a core member of our SEO team... There are no red flags with your intended approach.... That would 100% be my approach (and in fact is our approach on our Newsletters, which is a pretty similar situation to your documents/white papers).
