You won't be able to level up at all until you get past the Things Betwixt area -- essentially, the tutorial. Past that and through a narrow cave is a town called Majula.
When you first enter Majula, there is an area to the right which has a tall tower overlooking the sea. To the right of that, slightly down the cliff and by a tree, there is a green-cloaked woman known as the Emerald Herald. Once you speak to her, she will relocate to the Majula bonfire. Thereafter, you can speak to her and level up at that bonfire. Unlike Dark Souls, this is the only place you can spend souls to level up.
When speaking to her at the Majula bonfire, be sure to wait for a menu to popup. You may have to speak to her several times before the option becomes available.
As a side piece of advice, if you want to save your souls until you can first spend them, don't go down into the area with the two trolls. This is a difficult encounter for a new character. You can bypass that and come back to it later to fight them.
Disconnecting the console from the internet is the only sure way to prevent player invasions in Dark Souls 2.
That said, there are many conditions for both being able to invade and being susceptible to invasions, so your friend shouldn't have to worry too much. In my 72 hours of playing the game, I've been invaded only 3 times, not counting the areas belonging to the PvP-covenants. Those are entirely optional.
Like the comments above mention, you can minimize invasions while online for about an hour by burning a human effigy at a bonfire. The item description for the human effigy mentions this effect:
A warm, soft, shadow-like effigy. Use this item to reverse Hollowing.
It also weakens the links to other worlds, preventing invasions and
most cooperation. Peer closely at an effigy, and one begins to
perceive a human form, but whose form it takes depends on the person
looking. #
The Way of Blue supposedly summons available members of the Blue Sentinels covenant to help the Way of Blue player being invaded. I don't believe it matters whether the Way of Blue player is hollow or not, but the Blue Sentinel must be human, wearing the ring and also not fighting a boss or near a boss gate. With all these conditions, I'm not surprised people have seen few protectors these first few weeks after the game is out. Only a portion of players elect to join the Blue Sentinels, and then they both have to sacrifice a ring slot and not lose their humanity to be able to help.
Since your comment mentions the original Dark Souls, I'll add that in that game you would never be invaded if hollow; only in human form. So you could easily play through the whole game without disconnecting your console and never be invaded.
In my experience, invasions have resulted some of the most nerve-wrecking and adrenaline-filled battles in the Souls series. They've also been some of the most memorable, so I recommend not trying to prevent them.
Best Answer
The only person that sells Pharros Lockstones is Melentia. All other lockstones can be found on corpses or dropped from certain enemies.
The wiki has a full list of these locations.
Additionally (thanks to DoubleDouble) if you join the Rat Covenant, you can get Pharros Lockstones by defeating other players dragged into your world, or by killing a member of the Rat Covenant when you are dragged into theirs.