1 - Only if you want it to be an authenticated REST or SOAP API. You can make an anonymous API by creating a VisualForce Sites domain, editing the Public Access Settings for the Site and adding your REST or SOAP API class to the list of allowed classes in the related list at the bottom of the access settings.
If you go with an authenticated login then you'll need to follow the same process as API requests to Salesforce from external systems by first connecting to the Partner or Enterprise WSDL and doing the login to test.salesforce.com (sandbox), or login.salesforce.com (prod / Developer Edition). The login response will contain the proper endpoint to send the following requests and a session Id will be returned to use (SID) with the future requests.
2 - I've read that this can be related to not doing the login part I mentioned in part 1. The easy fix is make the Apex SOAP class public as mentioned above, the harder fix is to actually authenticate to the login servers and get a SID and proper pod url for further requests.
I personally avoid SOAP whenever I can unless I have a very specific need. I'd try to build it in REST first unless there was a very purpose for building it in SOAP. SOAP is cumbersome and I only prefer to use it when the receiving system doesn't give me an option, or I need a tightly controlled structure to the data being passed back and forth.