I am about to create a salesforce app that eventually will be delivered to appExchange, this app has a setting page that requires the user to enter his token that he uses to consume an external API. My question is: is it ok to store that token in a custom field eg: Token__c in the user Object ?
You'll want to read Secure Coding: Storing Secrets. It is recommended that you use a Custom Setting that is Protected so that the secret cannot be used outside of your app's code. Other alternatives are also possible, so you'll want to check out your options.