A zero has the same number of IO pins then a UNO, they use the same header layout. So I believe you want to use the chips on a self made PCB. (?)
Based on this, I think a second SAMD21 is not the best solution.
They are easily connectable as they use the same Voltage. I used the SPI lib on a zero, so yes, I think its programmable with Arduino techniques. And you can use a CS pin of your choice. The SPI lib uses Arduino header files for the selected platform. So the MCU clock speed shouldn't be a problem.
But you have to program the master and the slave and maintain this firmware. An MCP23(s/0)17 is ready to use.
Two MCP23S17 (QFN packages) don't take that much space.
SAMD21 is capable of driving max. 3.6 V; MCP can handle 5.5 V. (But if you want to use 5V you have to level shift the connection between your Arduino zero and the MCP.
And adding two more MCP23S17 is way easier that adding a third SAMD21, when even the old firmware must be reprogrammed.
A MCP23S17 can drive and sink 25 mA on each pin.
A SAMD21 can handle 14 mA source current and 19.5 mA sink current per IO cluster (there are 6 clusters each of them has between 2 and 16 pins).
On the other hand, if you are sure, you don't need more than 3.6 volts and ~1 mA per pin and the number of the additional IO pins is enough, there is no reason not to use a second SAMD21.
If you need capacitive touch pins, or more I2S ports or other capabilities of the SAMD21, then the second SAMD21 is even the better choice.
Have you seen the Arduino DUE? It has all the features of a zero and way more IO pins (54) and 12 analog inputs and 2 real analog outputs.