1) Once you have cfw and emunand, you can freely update emunand, but make sure you are in emunand (if you follow pailects guide, your system settings should say "emu [firmware]") I think you are able to go online with a homebrew app called ctr(?)-httppwn.
2) CIAs are safe to be played online
3) Probably the safest way of downloading games is by using something like freeshop or ciangel, but if you don't want to make your ds do the work (because its slow) you can google "that iso site" (don't post the link here, etc.) and it is probably one of the better places to get roms.