Coming back to answer my own question. The answers above were true at the time but IETF no longer recommends using User Agent at all. As well, Web Server flows have been updated to not require a consumer secret so the updated answer is that you should always use "web server" (authorization code grant) but if the app cannot protect a client secret, ...
I suspect the entityID of the connected app you installed through the managed package is the same as the url for org one. This is why the service is taking you back.
This assumes you want the org this package is installed in to act as a new IDP.
The user Id alone should be sufficient. The only time a user Id is duplicated is when the user is copied into a Sandbox from a Production environment; the Id technically refers to the same user that exists in different orgs. That said, you could decide to go with a user-id/org-id pair, as that is definitely a unique value.