Fix Conflicting IO Standards
As you have surmised, you get errors when you have incompatible IO standards in the same bank. It's best to know exactly how this stuff works, because the tools will gladly give you a bitfile that ends up burning out your FPGA due to incompatible IO.

As you posted above, we can consult the Xilinx datasheet for the device family, DS312. Supported IOSTANDARDs are set by the VCCO of a given bank. Notice that input and output are supported only when the number in the IOSTANDARD matches the voltage; input is supported for anything equal or lower. 



Now look at the last page of the Basys2 schematic.



It appears that all the VCCO's are connected to 3.3 volts. This means that you can do LVCMOS33 input/output, and all other LVCMOS input. You cannot do the LVCMOS18 output that you would like to do. If the UCF was set up for LVCMOS33 on all the other pins, the tools would recognize the impossibility of what you're trying to do and give an error. As it stands, the IOSTANDARDs in the UCF are blank, which default to LVCMOS25, and so the tools detect a mismatch.

You might be wondering why Diligent set up their UCF the way they did, since everything defaults to 2.5 volts when the board is actually 3.3. I don't know. The point is that the FPGA accepts pin settings without complaint, as long as the settings are consistent within the bank; it's up to you to make sure the external voltage matches. So you could "fix" your problem by setting a whole bank to LVCMOS18, but then you would probably fry your SPI device with 3.3 volts.

The way I see it, you have several options.


Serious surgery on the Basys2 board, changing the VCCO's appropriately. Probably not worth it.
External level shifting circuitry. You can read the serial input just fine, but the other SPI signals have to be shifted down. You can either do this with something like an 74LVC series logic chip, some series FETs, or just resistor dividers.
Current limiting resistors. This method relies on the clamping diode in the target device to limit the voltage, and the resistor limits the current to a safe level. There are resistors out to the PMOD pins, but they're probably not enough. Do due diligence if you choose this option.