The best option seems to be to use Visual Studio '08 and run the "Upgrade Wizard" when opening the project.
Well, that's certainly an approach that some people have had success with as a starting point, but don't expect it to solve all your problems with migrating a codebase that you're not familiar with to a new platform. It can update the syntax of many things so that it can compile in VB.NET, but that's really all it can do.
Is it ok for me to just download a copy off of an external source?
Well, I'm not sure what you mean by "ok". I certainly wouldn't want to run code on my system that I randomly found on the Internet on a site as sketchy as that one. Even if it was a real copy of the component I needed and didn't have malware attached, I wouldn't know if it was actually the same version as what the application had been testing and running with. I don't know anything about that particular component, but it may also be a violation of the licensing agreement from when your company bought that component.
If you really need to just find the file rather than finding the installer from when you initially acquired the component, I'd think you would want to get the copy from the system that's currently being used for development, or (if there isn't a development system set up anymore) a copy that's currently installed wherever the application is being run. Some components require more than just the .ocx file in order to run, however.
What would be the right location for me to put this .ocx file in order to make this work?
Well, generally the installer for a component will register it for you. For many components, as long as it doesn't need any other files you can pretty much put it anywhere as long as you register it. Registering it yourself, if you have to, can be done with regsvr32, or you can browse to the file within the Components dialog box in the VB6 IDE.