My rough idea is that I should put CS low, then read two bytes using SPI.transfer() twice, and then bring CS high again. Is that correct?
Yes, that is correct.
But looks like the AD7476 doesn't have any buffer, so I guess timing must be really precise in order to not miss any bit?
No. The conversion is controlled by the SPI clock. The ADC is a successive approximation ADC. That means for each "sample clock" a more accurate approximation of the voltage is created. In this instance that "sample clock" is the same as the "SPI clock". Each time you send one clock pulse a new, more accurate, approximation is created.
what if SPI.transfer() occurs too late after CS going low?
Within reason, nothing untoward.
The way an SAR ADC works is it uses a DAC which is controlled by a clock to create a voltage. That voltage is halfway between 0V and "the current estimated voltage" (starting at "vref" - 5V in this case). The voltage is compared with the "sampled" voltage (stored in a tiny capacitor). That forms one bit of the resultant value. At the next clock the DAC voltage is halved (and maybe added to the previous voltage depending on the previous comparison result) and repeated. This is the next bit of the result. It repeats with the voltage getting smaller and smaller and smaller.
Each time you clock one bit through your SPI interface it generates and compares the next voltage generating the next bit of data for you to read.
The knock-on effect of this is that there is both a maximum and a minimum frequency that you can use the SPI interface at. Too fast and it is unable to generate the comparison voltages and do the comparison in time. Too slow and the internal capacitor loses charge through self-discharge and leakage current. Thgis is why on page 8 of the datasheet it specifies a minimum and a maximum frequency for the SPI interface (10kHz to 20MHz).