You can report a player on Steam.
To do this, open Steam overlay in-game (Shift+Tab by default), click "View Players" in the Friends box.
This will show you all players you've met in Steam games, ordered by time.
If you have already left the game, same list can be accessed from Steam client menu, View -> Players.
From the list, find the suspected cheater and navigate to their profile. You can report the player from there.
Source: Steamcommunity
There's a few things controlling when you can summon someone (even with the password on).
First off, when you have password summoning on, the soul-range system is overridden, so your level 100 friend can come help your level 20 character, they will just get a normalizing damage reduction.
Second, if you are in an area where you have defeated all bosses in that area, you cannot summon anyone, regardless. You used to be able to forgoe this in Dark Souls and Dark Souls II with the Small White Sign Soapstone, but that doesn't seem to be the case in 3, as I haven't seen that item in-game. The exception to this rule is that you can do PVP summons (red sign soapstone, etc.).
Third, the summoner must have used an ember (or defeated a boss) restoring them to be a Host of Ember.
Finally, Dark Souls also enforces a "summoning cooldown" at times, limiting when you can summon your friend.
If all these conditions are met, you should be able to summon. Keep in mind it can take up to a few minutes (in my experience) for summoning signs to appear.
Also, just a sidenote: the Dark Souls netcode is sometimes a bit buggy. There are certain areas I cannot summon my friends in, but they can summon me, regardless of us having the same progress. While it's not foolproof, sometimes both the summoner and the summonee restarting Dark Souls 3 completely.
Best Answer
IMPORTANT: This answer only discusses the base game (in which I have 100%) as I didn't come around to play the DLCs yet.
Now you need to understand something essential: Dark Souls would never stop you from killing NPCs, and quests aren't always very clearly cut, nor do you have a way of looking them up in-game. The only real exemption are those with which you can achieve a different ending (aka a different 10-seconds cut-scene after the last boss).
Some of them have interesting weapons/armor/spells as reward, but I'd honestly suggest you to simply play and not take the fun out of it by reading it up on the Internet. Nothing really comes close to the feeling when you actually go through an interesting quest-line without knowing what comes next.
Honestly the biggest downside of killing NPCs is probably that some merchants will force you to pay more.
NPCs you can kill (excluding merchants + Quest relevant):
However, don't fret if you already killed some of them: you probably already broke a lot of more quests and you can't do them all in one run (anymore) anyway. Also, you will be able to buy the armor of many NPCs after killing them from the Shrine Handmaiden.
Additional Fun-Fact (Spoiler):