It still may not work. If "other-side-device" using 5V signals on SPI, then it will also expect 5V signals form STM32. Unlike I2C (where you can use pull-ups with any voltage required) SPI reqires some of it's pins (MOSI and SCLK) to be push-pull outputs with 2.8V range.
In primer2 it will be a bad idea because SPI is connected to audio codec!
I recomend you find a low-voltage version of your "other-size-device", or use some kind of convertor.