They randomly appear in your pokédex while your ds is alseep or in use as long as you have spotpass activated and have access to wi-fi. I think when its off too. You can get up to 3 new pokemon a day. Sometimes the little blue notification will show up at the bottom right of the app letting you know that you have a new pokémon waiting for download. Sometimes it wont be there and you will have a new pokémon so you should check in every once in a while.
Yes the last 4 spots are supposed to be empty. They are Keldeo, Meloetta, and Genesect. They wont be released until nintendo releases them in future events.
Also I have 63 pokémon currently in my pokédex so I know how it works.