The runlevel does not have any security implication.
Runlevels S, 0, 1 and 6 are special-purpose (for startup, shutdown, maintenance and reboot respectively). The system configuration in these runlevels is incomplete (for example, the network may be down or heavily restricted), and application servers such as a database are supposed to be off.
Runlevels 2, 3, 4 and 5 are general-purpose. Under Debian, they are configured in exactly the same way by default.
You can introduce a distinction between (for example) runlevels 2 and 3, but don't do it for the sake of introducing a distinction. Do it only if you find a reason why you would be running different sets of services at different times. There is generally no point: in most setups, either your services are running properly, or something really bad is happening that preventing your services from running.
Controlling who can log in is not done through runlevels (unless you want different sets of users to be allowed at different times, and again, this would be a weird requirement, and it probably wouldn't be done through runlevels anyway). If you want to be the only user who can log in, don't create accounts for other people.