Actually, you’re both right, and both slightly wrong.
Baptism by water is the ordinary form. But the Catholic Church also recognizes Baptism of Desire. The underlying principle is exactly what your Protestant friend is suggesting: true Baptism is by the Spirit.
However, we are human, and as humans we are a body-spirit/soul union. God could certainly have us be baptised by Spirit alone. He could also have us be baptised by water alone. But God desires that our whole nature should be involved in any act. Thus, just as our bodies are the outward signs of the spiritual principle within, likewise has He given us Sacraments that are outward signs of inwardly active grace. Baptism by water is batism by the Spirit, in the ordinary form of the Sacrament. Yes, God can Baptise us by Spirit alone (ie, Baptism of Desire), but He prefers we use the outward sign of water to signify the spiritual activity being done. That is how He created us.
We are not angels, and we are not animals. Acting upon every physical urge we have is animalism, and is not good. Likewise, acting in a rigorously anti-body manner, puritanism, gnosticism, etc, is spiritualism, and is also bad. We must act with our bodies and souls in communion. The spirit is primary, yes, but in every action both must be involved. When I kneel to the Lord, my spirit is the primary actor, but my body is essentially a part of the act. You cannot divide the two.
Likewise, if we try to separate this gift of Baptism into its constituent parts, then we’re doing something wrong. It’s not water-only, and it’s also not Spirit-only. It’s both. The Spirit is the primary actor, but the water is an essential component of the act. Spirit alone is efficacious, but that’s not what God intended.