McTominay scored early in each half as Scotland produced a solid display which left Spain few options in the first defeat of Luis de la Fuente's time as head coach.
De la Fuente made eight changes to the side which had beaten Norway 3-0 on Saturday, with only goalkeeper Kepa Arrizabalaga and central midfielders Rodri and Mikel Merino keeping their places, while Scotland coach Steve Clarke brought Lyndon Dykes in for the injured Che Adams and McTominay also started after having scored twice against Cyprus.
The game was just seven minutes old when the Manchester United midfielder put Scotland ahead. Andy Robertson pressured Pedro Porro, who slipped at the wrong time, allowing Robertson to pull the ball back for the onrushing McTominay to score with the help of a slight deflection past the wrong-footed Kepa.
Spain looked to react with Saturday's two-goal hero Joselu heading Jose Luis Gaya's cross straight at Angus Gunn, before then seeing another header from Merino's ball bounce back off the crossbar.
Spain were seeing more of the ball now, but the game was also getting niggly, with Robertson and Dykes both seeing yellow cards for Scotland, with Dykes leading with his forearm against debutant David Garcia.
Despite Spain's timid pressure, Dykes should have doubled Scotland's lead on the stroke of halftime when he got behind the Spain defense after timing his run from inside his half. The striker had only Kepa to beat, but Garcia did enough to put him off and his chip went over the bar.
Porro and Mikel Oyarzabal were substituted by Nico Williams and Dani Carvajal in the second half, while Swiss referee Sandro Scharer was replaced by fourth official Lukas Fahndrich after pulling a muscle.
McTominay doubled Scotland's lead in the 50th minute after Kieran Tierney left Carvajal in his wake, and although his cross was poor, it deflected off Garcia to fall kindly for the midfielder to fire home from the edge of the area.
It could have been 3-0 moments later when John McGinn's free-kick whipped against the bar.
Scotland then dedicated themselves to frustrating Spain, with two close lines of players across the park denying the visitors space in attack. Spain's only danger came through Williams' pace and trickery down the right wing, suggesting De la Fuente needs to go back to the drawing board.
