SPI devices use a push-pull configuration and no pull up resistors are required.
You should not leave the /CS pins floating if using a device like a multiplexor to choose different devices. For this case, the unused devices /CS pin should be high and the used devices /CS pin should be low.