SPI clock signal (SCLK) usage in FPGA SPI slave
As soon as you introduce a SPI slave interface into your FPGA design, you introduce a new clock (the SPI clock) and a second clock domain. All of the SPI signals belong to that second domain, and you are now faced with the problem of reliably transferring information across the boundary. This is commonly referred to as &quot;CDC&quot; (clock domain crossing), and there's plenty of information about this topic if you search for it.
By far the most common approach, if the FPGA's main clock is fast enough, is to synchronize the three incoming signals (SSEL, SCLK, MOSI) into the main clock domain right away (two FFs per signal), run the SPI state machine in that clock domain, and ignore the jitter that this introduces into the output signal (MISO) feeding back into the SPI clock domain. This generally works fine.
An alternative approach is to run the SPI state machine in the SPI clock domain, and transfer information between the two clock domains a byte or word at a time using asynchronous (dual-clock) FIFOs. This approach can potentially run faster, but it requires careful design of the state machine that takes into account the limited number of clock edges available to it.
In either case, you will have one set of timing constraints for the FPGA clock domain, another set of constraints for the SPI clock domain, and a third set that covers the CDC.