During normal operations, CLK is always driven, whereas CMD and DATA are bidirectional.
CMD must be pulled-up as frames begin with a low start bit and end with a high stop bit.
DATA[0] is used as a busy signal and must also be pulled high.
The other data lines DATA[1:3] could be left unconnected, but it is better when CMOS I/O are not left in high impedance 'middle' state. A pullup or weak keeper should be used, the ones inside the FPGA may be enough.
As long as the clock does not oscillate much during power-up, it could be left as-is. There is a long initialization sequence needing many clock cycles (at 400kHz...) anyway.
Pull-ups in FPGAs are usually not meant for polarizing external components, only the FPGA own pins. So an external resistor is better.
Serial resistors (for example 50 ohms) allow to reduce overshoots and glitches. It is particularly useful for the clock. You could also set a low output current to the FPGA pins (but it will degrade the Tdo delay).
Finally, SD to microSD adapters are entirely passive (like PCMCIA to CompactFlash adapters...)
There are some explanations in this old SanDisk document : http://cdn.sparkfun.com/datasheets/Components/General/SDSpec.pdf