Question 1: How can I build a proper windows installer for my VSTO add-in, to ensure that clients only need to download and execute one file, and further do not get any security warnings?
As to the last question, I don't think there's any way around the security warnings. Files that arrive from the internet have something MS calls Mark Of The Web. Once the file is downloaded, the user can clear this in the file's Properties dialog by clicking Unblock here:
If it's left uncleared, they'll get warning messages. Unfortunately, I don't believe there's any way around this, though it might help to distribute files inside a ZIP archive. But then the user has to know how to extract the enclosed files.