2mm !!!
If you use 4mm you can do it like this
and still be able to undo the knots easily (that's a figure of eight knot even though it doesn't look like it). Doing it this way means you only need a 4mm hole. The loop-and-knot method means you don't have to untie knots but the hole has to be twice the size. I've never had a problem undoing the knots.
As far as the drilling goes you can tap around to see if it feels solid where you are going to drill. If you go through foam or you can see open space inside the hole you can always fill the gaps with a bit of epoxy.
Putting a bit of tube (plastic or steel) will finish it off nicely but is optional.