As it is a Chromebook and not a Windows OS laptop, there is already a lot of built in protection due to the way Chrome "sandboxes" everything and uses "verified boot".
You can still add extra protection if you want, it's not going to harm the machine Putting on something like Malwarebytes will check any new app installation (as does the Chrome OS itself). Bear in mind any free app will have adverts. Use Google Play to add and install anything as the apps from there are verified.
Make sure the machine is kept up to date with the service packs from Google