As of the current version (available Jul 8 '12), you cannot disable PVP (being able to hurt each other). Maybe in future updates they will change that and maybe even allow more server options like the PC version. Sorry that this is not what you wanted to hear.
There is an option called Trust Players. When disabled, this allows you to chose what ever your friend is allowed to do. One of the options is to attack players. To start, press back and activate your friend and chose the privalage can attack players.