You're correct, you can access the 128MBit SPI Flash as any other read-only memory mapped memory -- you can execute out of it or load data (you can also write to it but need to use a seperate channel, it's not directly memory mapped to write).
You're also correct on the sizes of the ICache and Scratchpad. You can execute code which resides in the scratchpad, but can't store data in the I-Cache.
The RISC-V ISA defines different privilege levels: Machine, Hypervisor, Supervisor, User. It is possible for a chip to conform to the RISC-V Privilege Spec v1.9 by only implementing the bare metal or Machine mode, which is what the chip on this board does. So the chip on this board does not have User mode or an MMU.
You're also correct on the sizes of the ICache and Scratchpad. You can execute code which resides in the scratchpad, but can't store data in the I-Cache.