How to stop www-data's Apache processes?

Apache running as www-data is the default in Debian Lenny. You might be confusing a single 'parent' apache process (running as root) with apache 'children' doing HTTP request processing (running as www-data). Both 'parent' and 'children' processes should look like they were started with /usr/sbin/apache2 -k start (when you ps aux | grep apache), and the only difference is the process owner.

To control init startup scripts you could use sudo sysv-rc-conf (sudo aptitude install sysv-rc-conf if you don't have it - it is just an easy curses-like Perl wrapper for init scripts).

Those spare processes are there to cope with incoming request demands.

What you're looking for is MinSpareServers, but please read http://httpd.apache.org/docs/2.0/mod/prefork.html for why you might not want to lower it.

http://httpd.apache.org/docs/2.2/misc/perf-tuning.html might also be useful.