After searching in Oracle documentation:

If your password contains the "@" character, then the password must be enclosed in double quotes, and the quotes must be escaped using backslash (\).

sqlplus USER/\"P@123\"@TNS_ENTRY