FPGA remote upgrade question

Yes you are right. But do you need any communication from the CPU to the FPGA on the SPI bus to other things than access to the EPCS? If not then your solution is the simplest, but if yes, you will need a mechanism to know when to switch the CPU SPI bus from your application to the EPCS and back again.

To answer you other questions, the pins between the EPCS and the FPGA can be configured as regular I/O, so indeed you can do what you want with them in your application, including putting your own master or connecting directly the CPU's SPI bus to the EPCS. And to tell the FPGA to load the new image, you can either do it externally, with a hard reset as dsl said, or internally with the remote update IP.