Basically question is:
If we have
2048 what sizes for private exponents should Alice and Bob choose and why?
IF (that's a big "if") the generator g and the public element from the peer can be assumed to be part of a subgroup of prime order, THEN it suffices for exponents to have size 2t bits, for a "security level" of t bits. In other words, 256 bits are fine.
Now if p is a so-called "strong prime" (i.e. p is prime and (p-1)/2 is also prime), then any integer modulo p (except 0, 1 and p-1) necessarily has order (p-1)/2 or p-1, and a 257-bit exponent is sufficient. In fact, it is overkill because solving discrete logarithm modulo p will be easier than that, academically speaking (but this is all far in the "technologically infeasible" realm anyway).
If you are using Diffie-Hellman with a truly ephemeral DH key pair, to establish a shared secret with a specific peer and never reusing that DH secret for anything else, then you can just assume the DH parameters to be fine, because, by virtue of discarding the private DH key after usage, whatever nasty tricks played by the peer will impact that key exchange only. However, if you plan to reuse the same DH key pair to make of DH instances (e.g. a TLS server with a "DHE_RSA" cipher suite, that renews DH key pairs only when the service is restarted), then you have to be more careful because peers may submit bogus DH public keys to try to extract information from your own DH private key, and use that to attack other connections.