How to set environment variables for Django settings.py with Jenkins

I have a settings.py file for my Django project that reads in environment variables for some fields. This works great for local development. I'm not sure of how to make this work for my Jenkins build (Freestyle project). An extra layer of complexity is that some of these variables contain sensitive data (passwords, etc.) and so need to be secured.

So far, I have been able to use Credentials Binding Plugin to set up a secret .env file and can successfully access that as an environment variable.

1. How do I go about setting all the 'actual' variables from that file? Or is this bad practice?
2. If it's not bad, wouldn't those variables continue living on the server after the build has finished?
3. If it is bad, what is the better way to do this? I can update the settings.py file easily enough if needed to make this work.
4. Maybe using something like django-environ is the right approach?