You can have an online battle with a friend with both XY and ORAS, however there are a few restrictions on the person playing with ORAS:
- You cannot have Pokémon that hold Mega Stones not released in XY (e.g. Sceptilite, Beedrillite)
- You cannot use Pokémon with moves learnt in ORAS but not XY (e.g. Hyper Voice Sylveon)
- You cannot use Pokémon with Abilities available in ORAS but not XY
Source 1: Experience
Source 2: Serebii