To get a runner out who is trying to steal 2nd?

if the pitcher is still holding the ball when the runner goes, and the pitcher isn't actually pitching to home plate, the runner has made a big mistake.

However, technically, the runner has to be tagged - he's not forced out, so you can't just tag the base, but instead you have to tag the runner. Thus, if you throw to second base, and the runner keeps going, the second baseman (or shortstop, depending on who is covering second) has to tag him. If the runner changes his mind and goes back to first base, the first baseman (or whoever is covering first base) has to get the ball and tag him.

The pitcher should always throw to first in this situation.

The runner has to be tagged for the out. From that perspective, it doesn't matter where the pitcher throws the ball, since the throw itself doesn't get the runner out.

However, if the runner breaks from first, the pitcher throws to second, and the runner stops and heads back to first, that is a balk for throwing to an unoccupied base. (Rule 8.05(d).) First is considered occupied because the runner was there at the time of the pitch.

The only way a pitcher can throw a potential base stealer out at first is if the runner turns around and tries to get back to first before being tagged. Otherwise the first baseman would have to try to throw the runner out at second base. The runner must be tagged out as it does not qualify for a "force out".