Can NTA disect packets from a spanning port,(does it include a protocol analyzer), or does it have to get its data from one of the flow technologies?
No, you must send netflow records to NTA. You will need to use a probe that will convert what it sees at the span port into Netflow records that it sends to NTA. There are plenty of such devices on the market. Might want to start with Nprobe.
www.ntop.org/nProbe.html
This blog article covers the setup:
