That depends a bit on how fast you can deliver the information the ESP requests. If the information is constantly available and the Mega doesn't have computing intensive work to gather that information you may go up to about 4MHz with the SPI frequency. I don't think there's a technical minimal value but I would not go below about 100kHz just to have a reasonable speed.