How to prevent remote login for SYS

It depends what you are trying to do but one short answer is:

imp system/password@sid file=(filename) log=imp.log fromuser=(existing user) touser=(new user)

The last 3 here: log, fromuser, touser are optional. You might give some more details about what you are doing if that doesn't help...

Yes, you can have different versions of Oracle installed and running on the same server. I'd probably go with different listeners on different ports. And you wouldn't want two instances with the same name running. There's plenty of other areas you'd want to be sure they don't bump into each other (mostly disk locations).

That said, running two instances (other than dev/test) on one server isn't generally recommended. If they are small, you'd probably get better performance as separate schemas in one instance, and if they are big then go for separate servers. Also consider virtualization as an option.