You can choose not to grant Open Graph permissions to Spotify or revoke them at any point. Publish permissions are completely separate from authentication. Publishing can also be disabled from Spotify and there is also a private session mode that you can enable if you want to not publish one or two songs.

Disclaimer: FB engineer who uses Spotify all day every day.