MOK (Machine Owner Key) is about securing the boot process by only allowing approved OS components and drivers to run. MOK must be implemented by the "BIOS" - or some startup code inside the computer, anyway.
The main idea is that only code which is signed is allowed to run while loading the operating system (OS). Once that is booted, the OS can take over responsibility for securing the system from the BIOS.
The MOK system uses public key cryptography, which means that you can create a key pair, then sign, with your private/secret key, all components that are allowed to run. This includes the GRUB boot loader itself. Then the BIOS uses your public key (you need to install it) to check signatures before running the code.
Here are some docs on Secure Boot and MOK
The beauty of MOK, in my personal opinion, is that you can create the keys yourself and sign those components that you trust. In the past, the EFI BIOS had only Microsoft' public key installed and they were hesitant to sign Linux boot loaders :-) That's why you needed SHIM in the past (a go-between between EFI BIOS and GRUB).
All Secure Boot methods hope to secure the system from hackers and viruses by guaranteeing a cleanly booted system which is not tampered by malware. If startup code or drivers have been tampered with, it is detected so that you can act accordingly.
Kyle Rankin has done a lot of work on securing the boot process for the Librem range of Laptops, and here is a good article on his work. I believe it is well worth reading even if it is not directly applicable to your system - the idea is just the same.
ad 2) and 4)
Do you need MOK and Secure Boot? Not if you will never be successfully attacked by a hacker, especially one who might have physical access to your laptop or gains root access from the Internet through browser/office/Linux bugs.