If you're planning to export with CocoonJS (and Intel XDK too, I believe), the button object isn't supported, so you'll have to use sprites anyway.
When you say spam, do you mean click-spamming? To prevent this, give each sprite a timer that is activated upon each click, and only allow clicks once that timer has expired: use the Compare two values condition in the On touched object event, and check if the expression Sprite.Timer.CurrentTime("AntiSpam") is equal to 0.