When using --only-users <tool>, and using a tool user there's a first check that matches the template tools.<tool> and a second one that matches <tool>, so you can't really filter by those properly.
Example of log where the tool is filtered out:
root@cloudcontrol1005:~# ./maintain-dbusers maintain --only-user wdqsbe --account-type tool --debug
...
INFO [root.create_accounts:931]
create_accounts: skipping user tools.wdqsbe with account_type tool.
for test purposes, this user wasn't included in the list of target
users