Hi, I agree with a lot of what has already been said, so will just add a couple of things.
The main thing is this: HOW we react to something sends a clearer message than what we actually say. In other words, if we get hyper about something, the children will pick up on the anxiety and not necessarily pay attention to what we are really trying to teach them.
While I think it's prudent and necessary to protect our children from life's harms, so to speak, sometimes being over-protective causes children to want to do something even more, especially as they get older. (Just think back to your teenage years and how you wanted to do things your parents said you couldn't.)
I think you are on the right track by reinforcing his private parts and who can and cannot touch them. And you probably will need to do this many times without drama or judgment.
To compensate, there may be other areas of your son's life where you could make room for some experimenting: allowing him to go places or do things that you are protecting him from now. What about a kid's gym? Or an art class? Or any other venues where you leave him in the trusted care of other adults for, say, a 30-minute class. (There are zillions of ways to harbor experimentation and creativity w/o putting your child in harm's way. And they create great talking points and/or lessons from mommy and daddy.)
As kids grow and learn and experiment, they are going to go astray. As parents, we step in and remind them of where the boundaries are. I'm thinking that we want to be firm, without making a bid deal out of it. The bigger deal I make out of something w/ my 2-year-old usually provokes an equally arduous response on his part.
Please don't be ashamed. All kids experiment. I actually would be more worried if he wasn't curious. The fact that he was so nonchalent about it may indicate it's not that big a deal to him.
Also, I know a highly regarded child development specialist who would say that some of this behavior is because their testosterone levels are rising, and sometimes it just builds up and they look for an outlet. They aren't doing things in the same way as adults, i.e., we can't think of it as a boy kisssing another boy all over in the same way we would think of it as a man kissing another man all over. Our POV is as adults; theirs is a child's. A lot more harmless and innocent. They don't even know what they're doing, really! SO it's good to guide them without over-dramatizing.
And just be sure that the kids your son plays with are from families who share your parenting style and principles so that the boys get the same message from "both sides." One of the hardest things for kids to do is try to navigate conflicting messages from adults. They don't choose their
parents' POV just because it's their mom and dad. Sometimes the opposite.
And lastly, I am sure that you could find some great articles or resources online about how to deal with this. You might also ask your minister, or another youth minister, if you feel comfortable doing that,
I wish you all the best.