The depth of the jbox is a function of volume which is determined by wire fill. Here's a couple online calculators. They will tell you the cu in required which is labeled for any jbox you can buy. If it's just 1 or 2 14/2 romex cables, any standard lighting jbox should be good.
How the jboxes are secured depends on your jurisdiction. In my location, all outdoor jboxes (whether new or old work) have to the be secured to studs or attached to cross braces secured to studs. Your location may be different...
The building inspectors here want jboxes flush or just proud with the wall material unless that material is fireproof and wire-safe. Since stucco has metal lathe, that could pose a danger to the wires. Again, that is my local building department's position so your jurisdiction may be different.
EDIT: I did not quote the NEC as I am not electrician. I shared how my local building department (AHJ) interprets the code. I should have been more explicit in recommending you contact your building dept to determine what they require or how they interpret the relevant codes as this will probably be different.