The specification only makes mention of the 50K\$\Omega\$ pull-up internal to the card used for card detection. It talks about this in reference to the commands used to disable it. Search for "pull" to see all the mentions of it.
However, the SanDisk SD Card Product Manual is much more helpful. From Chapter 3:
\$^2\$ The extended DAT lines (DAT1-DAT3) are input on power up. They
start to operate as DAT lines after the SET_BUS_WIDTH command. It is
the responsibility of the host designer to connect external pullup
resistors to all data lines even if only DAT0 is to be used.
Otherwise, non-expected high current consumption may occur due to the
floating inputs of DAT1 & DAT2 (in case they are not used).
\$^3\$ After power up, this line is input with 50Kohm(+/-20Kohm) pull-up (can
be used for card detection or SPI mode selection). The pull-up may be
disconnected by the user, during regular data transfer, with
SET_CLR_CARD_DETECT (ACMD42) command.
\$^4\$ The ‘RSV’ pins are floating inputs. It is the responsibility of the
host designer to connect external pullup resistors to those lines. Otherwise
non-expected high current consumption may occur due to the floating
So you need to add pull-ups to all unused pins to prevent high-current from occurring due to the inputs being floating.
For the SPI signals that you will be using, pull-ups are not required. However if your traces are long or running through a noisy section on your board, or if you are running a high clock rate, adding pull-up resistors will help to clean up your signals transitions.