what else does
csrutil enable --without debug
do besides allowing TotalSpaces to run?
It is not officially documented.
The command enables SIP without enabling “debugging restrictions”. One of the debugging restrictions is inability to inject code into running processes (task_for_pid syscall) which is something TotalSpaces depends on to inject its code into the Dock process. Although we don’t know what else it exactly does, we assume it won’t make your system less secure than 10.10 (Yosemite).
For further info on SIP in general, I would recommend reading this article:
BTW, if you’re concerned about running your system with csrutil enable --without debug set, here are some technical instructions on how to install TotalSpaces and run with SIP fully enabled: http://totalspaces.binaryage.com/elcapitan-with-sip