By specification, Cyclone III JTAG and configuration can work with 3.3V. All customer designs I have seen up to now have been using 3.3V, for obvious reasons.
But there is some danger of damaging the chip by overshoots exceeding the absolute maximum voltage, thus Altera recommends 2.5V generally. I would read this as a recommendation to consider 2.5V VCCIO with new designs. One reason to continue using 3.3V is the unavailabability of AS configuration devices from Altera with 2.5V supply.
When using 3.3V, schottky clamps with series protection resistors at the external JTAG interface can guarantee to keep the maximum voltage specification.
There has been a longer discussion on this topic in the forum, I tried to summarize the key points in my subjective view.