Note that I have only used the V series FPGAs (mostly the Arria V). I think the 10 series is the same, but there might be differences.
Yes you can access the configuration flash after the FPGA loads. Altera provides some flash IP to help with that. If you just want to use the left over flash to store data then you are pretty much done. I haven't actually used this, but as I understand it their provided serial flash IP also understands the bitstream table of contents format. You can do is create a multi-page .POF file where the first page is the FPGA bitstream and one or more subsequent pages are data blocks. That way you automatically access the correct flash offset even when your FPGA bitstream changes size.
If you want to use the extra memory to support field upgrading or alternate bitstreams then you are expected to use the partial reconfiguration support. In this case, there is a bare-bones FPGA base image that acts similar to a bootloader plus one or more application images. The base image starts up and then selects which image to use and triggers partial reconfiguration. The idea is that you can have a "factory" application image plus a user updateable image. The "bootloader" will try to load the user image. If that fails for some reason it falls back to the factory image. This protects you against failed upgrades.
By default once configuration finishes the SPI pins go high impedance. It is possible (and I have done this) to connect a microcontroller SPI master in parallel to the FPGA. As long as you are careful about sequencing the microcontroller can do flash updates. For this you will want the microcontroller to also be connected to the nCONF, nSTATUS, and CONF_DONE pins of the FPGA so that it can control the configuration sequence and knows when it is complete or has failed.
A more complicated but more flexible way to do this (and one that is common on dev boards) is to switch from active serial mode. For instance a lot of dev boards use a MAX V or MAX10 CPLD that reads data from the SPI flash and programs the FPGA via the passive serial or passive parallel interface. Now you can connect a microcontroller to the CPLD to read/write the flash chip. Alternately you could just use a microcontroller instead of a CPLD which will be easier to program but may not boot as fast.
Note that this is all for FPGAs without hard processors. SoC type FPGAs can configure via active serial but normally do not. Instead, the HPS boots first and then loads the FPGA bitstream. This allows the bitstream to be stored anywhere the HPS can access -- it can be SD or eMMC flash, over a network or USB connection, or anything else.