The D+ and D- pins are 3.3V tolerant just like every other pin, and the USB data signals are 0 to 3.3V signals so no level translation is required. 

VBus is in fact 5V and cannot be directly fed into a GPIO without damage.  However as you can put a resistance in series with VBus and use the internal clamps to safely perform VBus detection with nothing more than that resistor. 

Timing requirements on VBus detection are very loose in the USB specification, so to better protect the internal clamps, I would up the size of your series resistor to 10k or 100k.

One thing to note: VBus detection is only required if you are a self power device application.  The spec says that the pullups and pulldowns inside a USB transceiver must be disconnected within 10 seconds of VBus removal.  If you are a bus powered application, the pull ups will obviously be removed automatically when VBus is removed because your application (f2806x) is powered by VBus.

Depending on the other application requirements, I would recommend using a GPIO that is capable of triggering an external interrupt for VBus detection.  You can do the same thing with polling, but interrupts are always cleaner if they are available.