Most rare candies are made by Silph Co. I say “most,” as in Hoenn, they’re actually manufactured by Devon. Additionally, there are plenty of knock-offs and bootlegs, but these can be dangerous to work with (if they’re effective at all), as depending on the company or region of origin, they may not have to go through the same testing and inspections that Silph or Devon candies do. Remember: always buy rare candies with blue or indigo wrappers. Anything else is a knock-off.
That having been said, they’re not exactly freely available because of their potency and effects. Sure, it’s possible to feed a pokémon dozens of candies, but it’s not recommended to do it to a hatchling because not only would this stunt their growth, but it also grants them access to abilities they physically cannot handle. (As you likely know, rare candies are a form of artificial battle experience. In other words, it triggers physiological responses that cause a pokémon’s body to think it’s achieved enough battle experience when it hasn’t—or in even shorter terms, it boosts a pokémon’s power. It is, in a sense, a performance drug, but in small doses, it’s legal, as I’ll get into in a moment.) For example, there has been more than one account of charmander or other fire-types being given enough candies to learn Flamethrower, only to subsequently either burn down their homes or rip apart their own flame sacs because the move is far too powerful for them to handle.
Granted, in small doses, it’s fine, as the increase in power from a handful of candies (for example, less than ten) is often so small that the target pokémon doesn’t notice, save to gain enough power to try a new move or evolve. There are very long and heavily detailed rules in the League about their use, but suffice to say, they’re legal in situations where prolonged battling (otherwise known among trainers as “grinding”) would do more harm than good to a pokémon.
Also, either way, they’re candies, meaning they’re made of sugar. You shouldn’t be feeding too many to your pokémon anyway, of course.
As for where you can find them, you can in fact find them at pokémarts, but you’d have to ask for them specifically. Additionally, you need to have a specific form of trainer’s or pokémon professional’s ID—one that shows you’re experienced to work with pokémon. (For trainers, this means that you’ve held your license for at least a year and have participated in at least one league tournament.) Most establishments will also limit the number you can buy per order—usually to just one or two—and the price alone is often enough to deter trainers.
Of course, you also have stories of trainers simply finding them on the ground, which I think is pretty bizarre myself because of how valuable they are, but suffice to say, I should perhaps warn you, readers, to be careful with blue- or indigo-wrapped candies that you simply find lying around too.