DIY flashlight - USB plug
It highly depends on the phone. Some do not power OTG devices.  Some will not enable power out if a slave device does not enumerate. And how much current you could pull depends too. If your only doing 20 to 300 mA your most likely okay. 

Yes, you connect the led and leds current limiting resistor in series between VCC and Gnd. Anode towards VCC obviously. 

As mentioned, as long as you keep the current low, it should work. The resistor will not change because all USB OTG devices should provide the same 5V power output. (Vsource - VForward) / IForward = Resistor value.