I would say 5-10 confirmations from the miners.
it is not just as simple as that. it depends on the risk model.
you may be receiving payment from someone you know: 0 is ok
you may be receiving small payments when everything about network is ok and you run a full node: 1 is ok
and so on. read this:
https://bitcoin.org/en/you-need-to-know#instant~
Yes, if you have bitcoin loaded on a physical device you can sell that device to anyone for any amount of money both parties agree upon.
i wouldn't call this "sending bitcoin" you are transferring a promise to the other person. you may make it safe and all but it will never be 100% safe unless you are the one creating a private key securely and send the coins to that.
the person selling you that physical device might as well have the keys.