EP4CE15 powers on to user IO pins at HIGH and not HIGH-Z

Having I/O pins connected to VCCIO and GND is fine, so long as you never drive those I/Os to a logic level that conflicts with the power rail you have connected it to.

You'd want to make sure you define the unused pins as inputs. Assignments->Device, Device and Pin Options, Category: Unused Pins, "As Input Tri-stated". There's a setting there for "As Input Tri-stated with weak pull-up". It would also be fine to use.

Alternatively, you can define all of those pins in your top-level HDL as inputs. That way they are always explicitly defined.

The Cyclone IV Handbook (CYIV-5V1-1.7) p266 has the section

--- Quote Start ---

i/o pins remain tri-stated during power-up

The output buffers of Cyclone IV devices are turned off during system power up or

power down. Cyclone IV devices do not drive out until the device is configured and

working in recommended operating conditions. The I/O pins are tri-stated until the

device enters user mode.

--- Quote End ---

Which is inconsistent with your observations. Try adding a pull-down to a signal and see if it gets pulled down during power-on. Drive it high in the configuration. Monitor the CONF_DONE signal. The signal that you have a pull-down on and drive high in HDL should be low until after CONF_DONE asserts (it should be low until INIT_DONE asserts).

Cheers,

Dave