Here are the instructions for the bossac.exe file: https://forum.arduino.cc/t/lower-memory-samd21-variant/890009/37.
If your board has an external crystal then the bootloader can be set to either use it, or in its absence the SAMD21's own on-chip internal 32.768kHz oscillator. If you've got an external crystal, the bootloader can be set to run with it.
On ARM microcontrollers the SPI port doesn't have any involvement with regard to the bootloader or the programmer used to upload it.