How to do pulling up or down correctly when interfacing a microSD card?
The specification only makes mention of the 50K\$\Omega\$ pull-up internal to the card used for card detection. It talks about this in reference to the commands used to disable it. Search for "pull" to see all the mentions of it.

However, the SanDisk SD Card Product Manual is much more helpful. From Chapter 3:


  \$^2\$ The extended DAT lines (DAT1-DAT3) are input on power up. They
  start to operate as DAT lines after the SET_BUS_WIDTH command. It is
  the responsibility of the host designer to connect external pullup
  resistors to all data lines even if only DAT0 is to be used.
  Otherwise, non-expected high current consumption may occur due to the
  floating inputs of DAT1 &amp; DAT2 (in case they are not used).
  
  \$^3\$ After power up, this line is input with 50Kohm(+/-20Kohm) pull-up (can
  be used for card detection or SPI mode selection). The pull-up may be
  disconnected by the user, during regular data transfer, with
  SET_CLR_CARD_DETECT (ACMD42) command.
  
  \$^4\$ The ‘RSV’ pins are floating inputs. It is the responsibility of the 
  host designer to connect external pullup resistors to those lines. Otherwise
  non-expected high current consumption may occur due to the floating
  inputs.


So you need to add pull-ups to all unused pins to prevent high-current from occurring due to the inputs being floating.

For the SPI signals that you will be using, pull-ups are not required. However if your traces are long or running through a noisy section on your board, or if you are running a high clock rate, adding pull-up resistors will help to clean up your signals transitions.