You cannot strictly speaking do either of these things.

> How to start the OAuth flow, when a customer install our package via the AppExchange?

You'll need to do this from a Setup or Configuration page within your application, or instruct the user in your documentation as to the steps to follow. You can't automate it without user intervention or do it from within your package post-install script.

> And/or how to install our package when a customer authorizes our Connected App?

You can't do that automatically. The customer needs to explicitly initiate a package installation. You could link to your AppExchange listing or preferred delivery vehicle from the page your web application presents after authorization is completed.