Which is the proper way to add Lightning calendar to Thunderbird (60+)?

Mozilla provides Lightning as bundled in the last versions, but Ubuntu (and Debian?) package do not [...]

yes, both do not, but they provide lightning via a seperate package (xul-ext-lightning resp. lightning) in their repositories.
debian also provides lang-packs (lightning-l10n-...) for lightning and ubuntu does not. --> that's IMHO the main issue.

[...] so now there is a mismatch between the Thunderbird version in the repositories and the add-on provided by Mozilla [...]

there isn't really a "mismatch"... for whatever reason mozilla simply does not provide lightning as add-on anymore.
EDIT: have a look at the last section of this answer.

(5.4, only useful for Thunderbird ≤52)

to avoid further confusion: lightning 5.4 is only intended to work with thunderbird 52.0!

---

there is no "one and only right solution" because every workaround has it's pros & cons and depends on your preferences and skills... nonetheless i try to prioritize them:

1. (if you are ok with lightning in english) the best is definitely to uninstall the lightning-addon and install lightning (xul-ext-lightning) via the repositories:
   https://askubuntu.com/a/1084095/354350

EDIT: at the latest now jump to the last section of this answer.

2. if you need a different language, probably extracting the {e2fda1a4-762b-4020-b5ad-a41df1933103}.xpi (=lightning-addon) from the official mozilla-releases (for every release) and installing into your profile via the addon-manager may be a reasonable workaround: https://askubuntu.com/a/1084220/354350
3. you can also use the archive provided by mozilla as a whole and update it on its own. - the packages (thunderbird* and xul-ext-lightning) from the repository should be uninstalled in this case.
4. _{if you are not afraid of potential bugs and do frequent backups of your data, installing the lightning-betas may also work for you:
   https://askubuntu.com/a/1084255/354350}
5. _{if you are a skilled tinkerer, you can perhaps use the debian-packages or parts of it (eventually with auto-update), but it is very likely you will end in dependency hell!}
6. if you are that skilled and seriously think about the last workaround, creating a PPA with lightnings lang-packs and providing them to all other users may be by far a better utilization of your time.
7. _{staying with an old thunderbird <60 for ages and using an already outdated lightning 5.4 is a really bad idea and should definitely be avoided!}

---

there may be 2 future-proof real solutions for all users, but i would not count on that we see even one of them soon:

• ubuntu should finally fix it's packages and include lang-packs into/for the lightning-package (xul-ext-lightning)! ...as debian does.
• mozilla could probably release lightning as add-on again and stop forcing users to fiddle around with separately downloaded betas and so on...
  EDIT: since january 2019 (after nearly 2 years) mozilla resp. thunderbird (re)published lightning >=6.2 (for thunderbird >=60) as addon again!