Unused GPIO pins shall be configured as pull up or pull down
The answer is: "it depends on your uC and system", as some IC draws a smaller current when the input is internally pulled up, others with a pull down. Other ICs (most AVR) only come with a pull-up option, so there's nothing to choose, except pu yes/no.

Still, you should avoid leaving them unconfigured without any pull-up/down. The high input impedance would have them to pick up all the noise (even by, but not limited to, capacitive coupling with nearby switching signals). This in turn, will make the input buffer to oscillate and waste "a lot of" power. Alternatively, the input voltage could come close to the midrail, where both the N and P MOSFETs of the input buffer are ON, something you want to avoid.

Another problem is: "what happens when the IC is initializing"? The unused inputs  will be uncofigured. The solutions?


Shorting to GND/VCC: this could be not a good idea, because if accidentally (due to a bug, or during testing) you configure the PIN as output, this will of course cause problems. Furthermore, a permanent short could be deleterious if later you must modify your circuit or having an unused pin to be monitored for debugging purpose. Shorting to VDD might also have latch-up problems (or erratic behaviors) in IC that have multiple supply voltages. 
Connecting a pull-up/down resistor. This takes space and BOM cost.
Live with it. If you expect a very short initialization/reset time, then you can live with this, and use the internal pu/pd.