To use unsigned kexts during first boot use bootflags rootless=0 and kext-dev-mode=1
The proper way of disable SIP later (I think) is to add to Clover's plist
I found this somewhere in the forum and for me it is working perfectly.
Thanks Green :-)
For installer and 1st boot 'boot with injected kexts' worked for me. Now have two issues, wireless kext not loading and showing USB over current error. I found something similar to disable SIP on an other forum, I'll try it.