You can either get the domain through the host, or a better option would be to use a website hosting like this to buy your domain first and then you have sole control of moving it around if you move servers in the future.
Remember though by law if you buy your domain yourself, your person information is public. They offer protection in that link above were if a person does a search on your Domain name. Your home addess and personal details are protected from public view, plus that website hosting above is one of the best on the net for buying domains. There is "GoDaddy" also
My friend Pete choose that option as he keeps a machine running all the time - however it is a *major* security security problem.
Despite running a very secure (read: minimal) setup the number of attacks was almost crippling as it was only a low-spec box.
That isn't why he's having security problems. It makes no difference secuity wise if you get the domain through your host or buy it yourself and tranfare the DNS to the host your with.
It sounds more like your saying he's hosting his website hosting from his PC (remote hosting) which is a bad idea and most ISP's will close your connection for doing that as unless you know what your doing your a hackers dream. And your ISP will see doing that as a secuity risk to them. Which is why most either don't like you doing it, or don't allow it.