Microsoft Office 365 – How to Convert Security Group to o365 Group

This means that I create AD Group, enable mail, and put users I want, in. Then, the replication will synchronize AD Group with O365 (with DirSync if I'm right).

That's pretty much it, yes. There's plenty of resources out there covering the installation and setup of DirSync, and you may refer to this table of attributes that are synced from on-premises AD to Office 365. You can manually trigger a sync of dirsync by opening DirSyncConfigShell and running Start-OnlineCoexistenceSync

So you can create a DG on-premises, set the Mail and ProxyAddresses attributes and then DirSync will create a synchronised DG in O365. This group will show up in the ECP > Groups, the same as a group which is created online. However, since the group was created on-premises it must be managed on-premises (as the sync is one-way). Trying to alter the attributes online will give you:

The action 'Set-DistributionGroup', 'PrimarySmtpAddress', can't be performed on the object 'IT-team' because the object is being synchronized from your on-premises organization.

There is no need to mail-enable the DG, as DGs are mail-enabled by default at creation.

To be clear, question is : Can I create a DG from local AD server in PS (Create-Group), by setting the mail address (and others attributes I dont now yet), and then Exchange will see it as a good DG and I'll be able to send email to it ?

Broadly yes. You'll have to use a PS cmdlet that actually exists though, ie New-ADGroup and specify -GroupCategory Distribution

There is no way to mail-enable an existing security group in AzureAD. you would need to recreate the group as mail-enabled through the Office365 Portal. Exchange ECP, or PowerShell. The latter can help you transfer settings and members.

If the security group is dynamic, you would lose this capability when converting. You can have a dynamic distro group (but it's not security group), or dynamic security group (that is not a distro group).