We have an external web platform and to fully integrate with Salesforce, we also created some Apex Code with classes and triggers to be packaged.
To authorize and make RESTful requests on behalf of our customers, we created one Connected App.
Questions:
I'm looking for good practice ideas, I appreciate any comment.
You cannot strictly speaking do either of these things.
How to start the OAuth flow, when a customer install our package via the AppExchange?
You'll need to do this from a Setup or Configuration page within your application, or instruct the user in your documentation as to the steps to follow. You can't automate it without user intervention or do it from within your package post-install script.
And/or how to install our package when a customer authorizes our Connected App?
You can't do that automatically.* The customer needs to explicitly initiate a package installation. You could link to your AppExchange listing or preferred delivery vehicle from the page your web application presents after authorization is completed.
* In some situations (if the customer authorizes a System Administrator), you could in fact automate this by making a call to the Tooling or Metadata APIs, but it's not a good idea. You should encourage your customers to authenticate with a least-privilege account, not a System Administrator, and since authorizing a Connected App is not generally understood to be authorization to install a managed package, you would be risking your user's trust.
