I think you are misreading the documentation. Installing a package, managed or otherwise, has nothing to do with accessing the API in GE/PE orgs. Instead, as you've already discovered:
I'm not fully understanding because I provided all the details of the connected app to partner support including the clientid and secret and support closed the case and told me that the connected app was whitelisted. I assumed that meant that as long as our mobile app authenticates with the clientid and secret, it could access the REST API in GE/PE.
That's it, you're done. Your OAuth application's client ID and secret key are already whitelisted for GE/PE orgs, so you need only log into a GE/PE org using an OAuth app that specifies those keys. Then your app will have API access.
My understanding is that SFDC whitelists the connected app in a MP so that upon package install you can use the rest API, is this incorrect?
This is incorrect, and additionally, your connected app ought not be part of the package definition.
What would be the best practice way of determining when a customer has installed the MP
Depends on your package. You could issue a global object describe and check for the presence of a custom object or setting included with your package, or you could issue a SOQL or SOSL query for an object that's included with your package. The results will tell you whether your package is installed.
and/or when to append the consumer key (client_id) in the OAuth flow to ensure that subsequent calls to the REST API can be completed (Specifically for Professional/Group editions)?
Every API call must always include your client ID and secret. This is how you identify to the server which OAuth app your native app is using. Again, it is irrelevant whether your package is installed in the org for the purposes of accessing the API.
