I want to define in my
Cisco switch a whitelist of allowed MAC, but MAC spoofing could allow any host to connect. How can I prevent MAC spoofing?
You don't prevent MAC spoofing, since it's entirely client-side. This is the reason that no one that really cares about security is using MAC whitelisting or blacklisting.
If you care about controlling what devices connect to your network, you should be using 802.1x with device certificates issued by your own internal CA that you control, or with some form on NAC like Cisco ISE or Microsoft NAP.
You cannot prevent MAC spoofing. The problem you're trying to solve is authentication. And the MAC address is simply not the right way to provide authentication since it can be spoofed very easily. There are even legit reasons to spoof a MAC address.
If you want to restrict which computers can connect, you have to use better methods than relying on the MAC address, preferably methods that levereage some sort of encryption.
Can't you somehow prevent it via switchport port-security?
You're not going to prevent an host to spoof its mac, but its spoofed traffic won't pass the access port.