SPI communication over different voltage
You need to be a bit careful with the 5V-tolerant inputs as they can only withstand Vdd + 4.0, which will be violated if the 3.3V supply is off when the 5V supply is present.
My preference is to use commercial voltage translators (the kind with two supplies and a direction pin) if you can't operate everything from 3.3V (the preferable solution) because SPI generally calls for high speed level shifting. For that reason, the kind of level shifting that uses passive pullups (such as the MOSFET method) is generally undesirable.