Streepass is OFFLINE, the 3DS can't even use Streetpass if online. As for sending info to Nintendo, that's not what Spotpass does, Nintendo gets the exact same information regardless of what "settings" you have. What DOES change is the sharing of information with other players on the 3DS and only that, so things like sharing in-game cards in some games, doing that daily visit thing on Pokemon Rumble World where other people can come once a day, getting people's secret bases in Pokemon ORAS, etc. are the ones that are affected by Spotpass, not Nintendo. You really thought Nintendo would let you choose an option to hide what you are doing on your system however against the EULA it may be?

And adding friends is perfectly safe, so don't worry.