There are cases where you absolutely must instantiate something from your vendor's libraries. But inference tristate I/O from a single concurrent statement will be safe (and also the recommended way to handle tristate i/o on the three platforms I've used).

    -- output data, driven active when \WR is LOW, high-Z otherwise
    d <= d_out WHEN wr_en_n = '0' ELSE (others => 'Z');

    -- input data
    d_in <= d;

Just don't bury the logic in some deeply nested if/else tree tree in a process or state machine, this is likely to not synthetize to what you had intended. :-).