No problem at all.
Firstly - yes you are correct, their phone will need unlocking. The easiest way to do this is to take it to a local phone shop, or market stall, and they can unlock it for a few pounds.
Then order a sim from your recruit page here:
By ordering from your page (rather than the general page), your friend will get an extra £5 credit when they activate and you will get 500 payback points (worth £5).
Once you have the sim, activate it on the giffgaff site here:
They will (temporarily) be given a new random number. The sim will probably activate within an hour or so, but can take up to 24 hours. Wait a full 24 hours for the sim to become active - and maybe check it is working OK at this point by putting it in your (unlocked) phone.
Then, with the Vodafone sim back in the phone, text the word ‘PAC’ to 65075. This will request a PAC code from Vodaphone for porting their number to giffgaff. Once you have it (it is valid for 30 days), plug it in here:
https://giffgaff.com/profile/details - click where it says "Keep my number" and put the PAC code in.
You will be assigned a transfer day a few days later. On that day, you will get a email saying the transfer is complete first thing. THIS IS NOT THE CASE! For some reason, the email is sent at the start of the process rather than the end. The process will take up to 9pm. Restart the phone periodically. Some services will transfer before others (for example, you maybe able to make a call, but not receive them etc.
Once complete - voila!