Fire up your Clover install package. On the 2nd page of the installer make sure to select your USB as the destination. We also want to Customize the installation - as the defaults are pretty lackluster.
The usual options you want to check in the Customize menu are shown in the following screenshots with an explanation of each after (Note: any non-Z370 300-series board will need EmuVariableUefi-64 as well):
Install Clover for UEFI booting only
Install Clover to the ESP
Under UEFI Drivers:
AptioMemoryFix (the new hotness that includes NVRAM fixes, as well as better memory management)
VBoxHfs-64 (or HFSPlus if available) - one of these is required for Clover to see and boot HFS+ volumes. If you see the option to enable it in the installer, make sure it's selected - if you don't see it in the installer, verify that one of them exists in the EFI -> CLOVER -> drivers64UEFI folder
ApfsDriverLoader - (Available in Dids' Clover builds - or here) this allows Clover to see and boot from APFS volumes by loading apfs.efi from ApfsContainer located on block device (if using AptioMemoryFix as well, requires R21 or newer)
If you don't need FileVault, and are setting up a standard UEFI installation, these are the only entries you should need. You may find more than the above selected in the UEFI Drivers section - feel free to deselect any not listed. There are some that can even cause conflicts with other settings/kexts (Like SMCHelper-64.efi), so it's a good idea to run as lean as possible here.
Once Clover has been installed, you'll see the EFI partition of your USB on the desktop - we want to navigate to /Volumes/EFI/EFI/CLOVER/kexts/Other and copy the kexts we downloaded earlier there. Make sure you unzip the kexts before copying them over. Any dSYM files can be ignored, we only want the .kext files.
But what about the 10.xx folders?
When Clover is looking to inject kexts, the kexts in the 10.xx folders are only injected if Clover determines that the folder name matches the booted OS version. There are very few kexts that are OS version-dependent though, and updating the OS while forgetting to migrate the kexts can leave you in an unbootable state. The kexts located in the Other folder will inject regardless of the detected OS version.